In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6… (CVE-2026-99076)

The Linux kernel vulnerability (CVE-2026-99076) involved the IPv6 UDP exception cache where exceptions were created only if a UDP packet matched an existing socket. This allowed off-path attackers to perform side-channel attacks to infer ephemeral UDP ports used by connected sockets. Previous mitigations involving hash randomization were bypassable. The implemented fix creates exceptions unconditionally before socket matching by invoking ip6_update_pmtu() and ip6_redirect(), ensuring that attacker guesses always result in observable cache updates. This approach prevents attackers from distinguishing valid from invalid guesses based on exception creation behavior. The fix may introduce extra route lookups and duplicate exceptions for the same destination IP but does not expand attacker capabilities beyond prior conditions.

An off-path attacker could use this vulnerability to conduct side-channel attacks on the IPv6 UDP exception cache to discover ephemeral UDP ports used by connected sockets. This information disclosure could aid in further network reconnaissance. However, the vulnerability does not allow attackers to create exceptions they could not previously create, and the fix mitigates the side-channel by normalizing exception creation behavior.

A fix has been implemented in the Linux kernel to always create exceptions before socket matching, mitigating the side-channel attack. No additional action is required beyond applying the updated kernel version containing this fix. Patch status is not explicitly stated in the provided data; users should consult the official Linux kernel advisories or updates for the fixed versions and apply them accordingly.