In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When… (CVE-2026-99030)

The Linux kernel vulnerability CVE-2026-99030 involves the skb_copy_and_csum_bits() function in the networking stack. When this function encounters unreadable fragments, it returns after copying only the linear portion of the buffer, leaving the remainder of the caller's buffer unchanged. Since the caller's buffer is used for network transmission (e.g., ICMP error packets or driver TX bounce buffers) and is not zeroed beforehand, residual memory contents may be transmitted unintentionally. The fix zeroes the unfilled portion of the buffer for positive length values to prevent leakage of stale data, ensuring that packets no longer carry unintended memory content.

The vulnerability could lead to unintended leakage of stale memory bytes in network packets sent by the affected Linux kernel. This may expose residual data from kernel memory in ICMP error messages or driver transmit buffers. Although the checksum mismatch typically causes the receiver to drop such packets, the exposure of unintended data could pose a confidentiality risk.

A fix has been implemented in the Linux kernel to zero the unfilled parts of the buffer in skb_copy_and_csum_bits(), preventing stale memory from being sent. Users should apply the official kernel updates that include this patch to remediate the vulnerability. No additional mitigation actions are indicated.