Linux Kernel CVE-2026-99077

Exploitation requires a victim host running a pre-patch Linux kernel that has a connected (or wildcard) UDP socket whose ephemeral port the attacker wants to discover, and an off-path attacker able to deliver ICMP Fragmentation-Needed or Redirect messages that the host locally processes. The limiting factors are substantial: it is a probabilistic side-channel (CVSS AC:H) requiring repeated guesses and observation of the FNHE cache rather than a single deterministic request, and it yields only the ephemeral port number - useful mainly as a precursor to off-path injection attacks, not direct host compromise. The description notes prior randomization/hashing mitigations exist but were bypassable, which is why the condition holds across hardened kernels until this fix is applied.

Signals are mixed and point to a moderate, patch-in-due-course priority rather than an emergency. The input CVSS of 7.4 (High) is driven by C:H/I:H, but that impact rating looks overstated against the described mechanism: the flaw is an off-path side-channel that lets an attacker infer the ephemeral port of a connected UDP socket by forcing FIB nexthop exceptions (FNHE) to be created before socket matching. That is fundamentally an information-disclosure/port-derandomization weakness whose primary value is enabling follow-on off-path injection (e.g. UDP/DNS spoofing), not direct high-confidentiality or high-integrity compromise of the host - verify the C:H/I:H weighting with the kernel CNA. The exploitation-difficulty signals agree with low real-world urgency: AC:H reflects the probing/collision work needed, EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis (the only references are the two stable patch commits and the NVD entry). The decision label is this_week, consistent with a High-severity but non-emergency kernel fix. The main amplifier is prevalence: Linux is ubiquitous, so even a niche side-channel has broad aggregate exposure and should be rolled out through normal kernel patch cycles. Note the description explicitly states prior mitigations (siphash hashing, randomized bucket occupancy) were bypassable, which is why the structural fix (always creating the FNHE) was needed.

An off-path attacker who cannot observe the victim's traffic wants to learn the ephemeral source port of a UDP connection (for example to then spoof DNS or other UDP responses). The attacker sends ICMP Fragmentation-Needed or Redirect messages that quote a UDP packet with guessed port values; because the kernel creates an observable FNHE before attempting to match a socket, a correct guess leaves a detectable change in the exception cache that the attacker can probe to confirm the port. No public exploit was identified at time of analysis, and the side-channel nature (AC:H) means it requires repeated probing rather than a single request.