Linux Kernel CVE-2026-99064

Exploitation requires the target kernel to have CIPSO (Commercial IP Security Option) / NetLabel labeled-networking processing active, and the attacker must send IP packets containing a CIPSO option followed by at least one other IP option (source-route/record-route/timestamp/router-alert) so that cipso_v4_skbuff_delattr() strips CIPSO and leaves a stale cached offset. Limiting factors: CIPSO labeling is a non-default, specialized configuration used mainly in MLS/labeled-security deployments, which is the basis for the AC:H rating; no authentication is required (PR:N) and no user interaction (UI:N), but systems without CIPSO enabled are not exposed. Affected builds are pre-fix kernels derived from base commit 89aa3619d141 up to the listed fixed versions.

This is a genuine but conditional kernel vulnerability rather than a mass-exploitation emergency. The CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly combines a network-reachable, unauthenticated trigger (AV:N/PR:N/UI:N) with high attack complexity (AC:H), and the AC:H is the key signal: exploitation depends on CIPSO/NetLabel labeled networking being enabled, which is a rare, specialized configuration. The multi-source signals are consistent and point AWAY from broad urgency: EPSS is only 0.21% (10th percentile), there is no CISA KEV listing, and no public exploit or PoC reference is present - only upstream stable git patch commits. The vuln.today decision label is 'this_week', i.e. scheduled patching, not act_now/emergency. No SSVC decision fields (exploitation/automatable/technical impact) were supplied, so that framework cannot be cross-referenced. The one point worth flagging: the description's concrete harm is an offset-confusion bug where __ip_options_echo() may treat packet data as an option length and copy it into fixed-size option storage - this is consistent with the C:H/I:H/A:H rating (potential kernel out-of-bounds read/write), but the vendor Tags label it only 'Information Disclosure', a narrower characterization than the full-impact CVSS; treat the exact memory-safety consequence as plausible-but-not-fully-verified from the available text.

On a Linux host configured with CIPSO/NetLabel IP option labeling, a remote attacker sends crafted IP packets containing a CIPSO option followed by other IP options (such as record-route or timestamp); when the kernel strips the CIPSO bytes without fixing the cached option offsets, downstream code reads or copies the wrong bytes, potentially leaking kernel memory or corrupting fixed-size option storage. No public exploit or PoC code has been identified, and the attack requires the non-default CIPSO labeling feature plus high complexity to land reliably.