{"apiVersion":"1.0","identifier":"CVE-2026-99064","description":"In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a seven-byte RR option, parsing records rr at offset 30. Removing CIPSO moves RR to offset 20, while the cached offset remains 30. Consumers such as ip_forward_options() and __ip_options_echo() then access the wrong bytes; the latter may interpret packet data as the option length and copy it into fixed-size option storage. Mirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and router_alert offsets when they follow CIPSO. cipso_len is the distance the first memmove() shifts those options. The later header move and network-header reset relocate the bytes and their offset base together.","publishedAt":"2026-10-23T13:17:30","lastModifiedAt":"2026-10-24T14:16:54","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99064","cvssScore":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00516,"riskScore":0.85,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99064","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99064","en":"https://www.redsauce.net/en/cves/CVE-2026-99064","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99064","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99064","de":"https://www.redsauce.net/de/cves/CVE-2026-99064","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99064","el":"https://www.redsauce.net/el/cves/CVE-2026-99064"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99064"}}