Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f43798c27684ab925adde7d8acc34c78c6e50df8 to < a464d950f31c89565cbaae038cc60db04fe01956affectedf43798c27684ab925adde7d8acc34c78c6e50df8 to < 0fab003ef4698e0628060a45a48f14b43ba2a40aaffectedf43798c27684ab925adde7d8acc34c78c6e50df8 to < 94524b7b32691de2e2ce162c04d6cbc9106e5cbfaffectedf43798c27684ab925adde7d8acc34c78c6e50df8 to < a65f69e0f38ffbed1b128029e09097436416dc8baffectedf43798c27684ab925adde7d8acc34c78c6e50df8 to < 32a8b0adaa18e52aaa0b246b5ffe683075354dbbaffectedf43798c27684ab925adde7d8acc34c78c6e50df8 to < f3e835af6226f1dd12160cbd696081e9b6155de0affectedf43798c27684ab925adde7d8acc34c78c6e50df8 to < c3e33464746166264334641dc850a36eef7e6326affectedf43798c27684ab925adde7d8acc34c78c6e50df8 to < 6785011f8b16abf40b1e9d8b2e332232b3e68822affected
Linux Linux
Default version status: affected
2.6.27affected0 to < 2.6.27unaffected5.10.272 to ≤ 5.10.*unaffected5.15.223 to ≤ 5.15.*unaffected6.1.190 to ≤ 6.1.*unaffected6.6.159 to ≤ 6.6.*unaffected6.12.113 to ≤ 6.12.*unaffected6.18.57 to ≤ 6.18.*unaffected7.2.11 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956 ↗
- https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a ↗
- https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf ↗
- https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b ↗
- https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb ↗
- https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0 ↗
- https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326 ↗
- https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822 ↗
- https://pwn.ai/blog/pwnescape ↗
- https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge ↗
- http://www.openwall.com/lists/oss-security/2026/10/15/5 ↗