Описание
In the Linux kernel, the following vulnerability has been resolved:
ipv4: validate checksum_start before completing checksum
If a packet with bad checksum metadata gets into the ipv4 stack,
skb_checksum_help can corrupt the network header and cause a bunch of
mischief.
This was discovered and reported by Paulos, and has been reporoduced
by others independently since.
We really shouldn't allow such packets in, but as a defence
in depth measure, let's also check before we complete the checksum.
A more complete validation at input is forthcoming, but needs more work.
A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during packet handling, potentially leading to arbitrary code execution on the host, a system crash resulting in Denial of Service (DoS), or information disclosure of sensitive memory.
Отчет
This IMPORTANT-severity flaw affects the Linux kernel as shipped in Red Hat products, including the kernel and kernel-rt packages in Red Hat Enterprise Linux and the kernels shipped in Red Hat In-Vehicle OS. The IPv4 networking subsystem does not validate packet checksum metadata before completing a checksum: when a packet with a malformed checksum_start value enters the IPv4 stack, skb_checksum_help() can write out of bounds and corrupt the network header and other kernel memory (CWE-787). A local attacker or an untrusted guest virtual machine able to transmit such packets into an affected host could exploit this to crash the system (denial of service), disclose sensitive kernel memory, or potentially execute arbitrary code on the host. Red Hat tracks this flaw as a KEV active-exploit case. All currently tracked Red Hat product streams are marked affected, and fixes are being pursued by the responsible Red Hat product teams under delegated resolution. Red Hat's severity differs from the upstream assessment: Red Hat assigns a CVSS 3.1 score of 8.8 (IMPORTANT, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), while the CVE.org record assigns 9.3 (CRITICAL, AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); the two assessments differ on the privileges-required metric.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Affected | ||
| Red Hat Enterprise Linux 8 | kernel | Affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected | ||
| NVIDIA for RHEL 10 | kernel | Fixed | RHSA-2026:85928 | 22.10.2026 |
| Red Hat Enterprise Linux 10 | kernel | Fixed | RHSA-2026:85321 | 19.10.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | kernel | Fixed | RHSA-2026:85979 | 20.10.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | kernel-rt | Fixed | RHSA-2026:88204 | 22.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
In the Linux kernel, the following vulnerability has been resolved: i ...
Уязвимость функции skb_checksum_help() реализации протокола IPv4 ядра операционной системы Linux, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
8.8 High
CVSS3