In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO… (CVE-2026-99064)

The Linux kernel contained a vulnerability in the cipso_v4_skbuff_delattr() function, which removes CIPSO bytes from network packets but does not update cached offsets for options following the CIPSO option. For example, if a CIPSO option is followed by a Record Route (RR) option, removing CIPSO shifts the RR option's position in the packet, but the cached offset remains unchanged. This discrepancy causes functions like ip_forward_options() and __ip_options_echo() to read incorrect bytes, potentially interpreting packet data as option length and copying it into fixed-size buffers incorrectly. The fix involves adjusting the cached option offsets by subtracting the CIPSO length from the offsets of subsequent options, ensuring correct parsing and memory handling.

Incorrect cached offsets for IP options following CIPSO can cause kernel functions to access wrong memory locations, potentially leading to memory corruption or incorrect packet processing. This may affect network packet handling reliability and could be exploited to cause denial of service or other unintended behavior in the kernel's IP options processing.

A fix has been implemented in the Linux kernel to adjust cached option offsets when removing CIPSO options, correcting the parsing and memory handling issues. Users should apply the official kernel update that includes this fix once available. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.