In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP… (CVE-2026-99077)

The Linux kernel vulnerability (CVE-2026-99077) involves the FNHE cache used for IPv4 UDP packets quoted by ICMP Fragmentation Needed and Redirect messages. Previously, FNHE entries were created only if the kernel matched the UDP packet to an existing socket, allowing off-path attackers to conduct side-channel attacks to discover ephemeral UDP ports. Attempts to mitigate this by randomizing hash functions and exception cache behavior were insufficient. The resolution is to always create or update FNHE entries regardless of socket matching, ensuring that attackers cannot infer socket existence from FNHE cache behavior. This change involves calling ipv4_update_pmtu() and ipv4_redirect() helpers unconditionally and passing an output interface of zero to maintain consistency with socket-bound behavior. The fix may cause extra route lookups and multiple exceptions for the same destination but prevents the side-channel attack vector.

The vulnerability allows off-path attackers to infer ephemeral UDP port numbers used by connected sockets via a side-channel attack on the FNHE cache. This could potentially aid in reconnaissance or targeted attacks relying on knowledge of UDP port usage. However, the vulnerability does not allow attackers to create FNHE entries beyond what was previously possible, and exploitation requires sending crafted ICMP error packets. There is no indication of direct code execution or denial of service from this vulnerability.

A fix has been implemented in the Linux kernel that changes FNHE creation behavior to always create or update exceptions before socket matching, effectively mitigating the side-channel attack. Users should apply the official kernel update containing this fix. Since this is a kernel-level vulnerability, upgrading to the patched kernel version is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.