CVE-2026-99077 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux users, network administrators, and security teams should assess exposure and apply patches to prevent potential side-channel attacks. They should also monitor network activity for suspicious behavior to detect potential exploitation attempts.

Why it matters

A vulnerability in the Linux kernel's IPv4 UDP implementation could allow an off-path attacker to conduct a side-channel attack on the FNHE cache to discover the ephemeral port used by a connected UDP socket. Linux kernel maintainers and users should assess exposure and apply patches.

• Verify Linux kernel versions and apply patches to prevent potential side-channel attacks
• Monitor network activity for suspicious behavior to detect potential exploitation attempts

Technical summary

The Linux kernel's IPv4 UDP implementation is vulnerable to a side-channel attack on the FNHE cache, allowing an off-path attacker to discover the ephemeral port used by a connected UDP socket. This vulnerability is due to the way exceptions are created before socket matching in the IPv4 UDP implementation. The vulnerability has been resolved by creating exceptions before trying to find a matching socket. Linux kernel maintainers and users should verify affected versions and apply patches to prevent potential side-channel attacks.

Defensive priority

Assess exposure: Linux kernel maintainers and users should verify affected versions and apply patches. Monitor for suspicious network activity.

Recommended defensive actions

• Verify Linux kernel versions and apply patches
• Monitor network activity for suspicious behavior
• Review system configurations and update as necessary
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and Linux kernel source code indicate a vulnerability in IPv4 UDP implementation. Specific details about the vulnerability are limited. The Linux kernel's IPv4 UDP implementation is vulnerable to a side-channel attack on the FNHE cache, allowing an off-path attacker to discover the ephemeral port used by a connected UDP socket. The vulnerability has been resolved by creating exceptions before socket matching.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.