UDP Socket Vulnerability in Linux Kernel

CVE-2026-99077

What is CVE-2026-99077?

A vulnerability in the Linux Kernel allows off-path attackers to exploit the FNHE cache through an incorrect handling of ICMP Fragmentation Needed and Redirect Message packets. This flaw creates an opportunity for these attackers to execute a side-channel attack by discovering ephemeral ports used by connected UDP sockets. Despite previous attempts to mitigate this risk by changing how FNHE hashes are managed, the vulnerabilities remain, as attackers can still utilize improperly validated helpers. The revised approach involves ensuring FNHE is created or updated consistently, even before socket matching is attempted, thereby exposing potential weakness that could lead to port discovery.

References