Linux Kernel CVE-2026-99030

Requires the kernel to reach the unreadable-fragment branch of skb_copy_and_csum_bits() - i.e. an skb whose frags are not CPU-readable, as arises with unreadable/devmem skb fragment handling added in the 6.12-era networking code - and for the result to flow into a wire-bound buffer that is not pre-zeroed: either an ICMP error quoting the offending packet or a TX bounce buffer via skb_copy_and_csum_dev(). Exploitation is materially LIMITED by: (1) the specialized, non-default networking configuration needed to produce unreadable frags; (2) the leaked data being whatever already occupied the reused buffer, not attacker-chosen memory; (3) the corrupted checksum, which causes most receivers to drop the packet, so reliable capture needs passive on-path observation rather than normal delivery; (4) applicability only to kernels carrying the vulnerable code (roughly 6.12 up to the listed fixed versions).

Signals point to a real but low-urgency defensive-hardening fix rather than an actively dangerous flaw. The supplied CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H) frames this as a trivially remote, unauthenticated, high-confidentiality disclosure - but that rating conflicts with the described mechanism and should be treated with caution. The leak only occurs when skb_copy_and_csum_bits() reaches UNREADABLE frags (the devmem/unreadable-skb-fragment code path introduced around kernel 6.12); this is a specialized, non-default condition, so the AC:L in the supplied vector likely understates real attack complexity - verify the trigger path with the kernel maintainers. The exposure is also self-limiting: the kernel's own note says the checksum usually will not match the stale data, so most receivers drop the packet, and the leaked bytes are whatever happened to be in a reused ICMP-quote or TX bounce buffer, not attacker-selected memory. Corroborating lower-priority signals: EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit or PoC reference is present - only the fix commits. The vuln.today decision label is 'this_week', consistent with routine stable-kernel patching rather than emergency response. Net: a genuine kernel memory-disclosure bug worth patching in the normal cycle, but the high CVSS overstates real-world risk given the niche precondition and self-limiting leak behavior.

On a host whose networking stack produces skbs with unreadable fragments (e.g. devmem TCP paths), the kernel builds an ICMP error quoting an offending packet, or a driver bounce buffer in skb_copy_and_csum_dev(), and skb_copy_and_csum_bits() stops after the linear part, leaving prior buffer contents in the remainder. An attacker positioned to observe the resulting network traffic captures those stale kernel bytes. No public exploit or PoC code is identified at time of analysis, and the trigger path itself is not described as attacker-controllable in the available sources.