ipv4: udp: Create exceptions before socket matching

{
  "id": "df33be1688edbd6038caee28d2705344770f972a5fe7f37e41602962b259d937",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-99077",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ipv4: udp: Create exceptions before socket matching",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception (FNHE) is only created if the kernel can match the UDP packet to an existing socket. This behavior allows off-path attackers to conduct a side-channel attack on the FNHE cache in order to discover the ephemeral port used by a connected UDP socket. Commit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in fnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache less predictible\") tried to mitigate such attacks by making it harder for attackers to discover hash collisions in the FNHE cache and by randomizing the number of exceptions a hash bucket can hold, respectively. Unfortunately, both of the mitigations can be bypassed. Instead, mitigate such attacks by always creating a FNHE, even before trying to find a matching socket. Do that by calling ipv4_update_pmtu() and ipv4_redirect(), the helpers used when the quoted packet did not originate from a socket. This means that guesses (right or wrong) from an off-path attacker will always result in a FNHE being created or updated in the cache that the attacker can observe. Pass an oif of 0, in a similar fashion to icmp_err(). This is also the oif used by the socket path for sockets that are not bound to a device. Note that this does not allow attackers to crea",
    "evidence": "cve:CVE-2026-99077",
    "products": [
      {
        "name": {
          "value": "Linux",
          "evidence": "/containers/cna/affected/0/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "Linux",
          "evidence": "/containers/cna/affected/1/product"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-99077",
      "aliases": [
        "CVE-2026-99077"
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "version": "3.1",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote IPv4 ICMP Fragmentation Needed or Redirect message carries the attacker-controlled inner IPv4/UDP quote through ip_rcv(), icmp_rcv(), icmp_socket_deliver(), and udp_err(), where its guessed four-tuple is matched.\nAC:H - Exploiting a connected socket requires turning fnhe_hashfun() bucket occupancy and update_or_create_fnhe() eviction into an oracle while the UDP tuple remains live; keyed hashing, randomized bucket depth, cache noise, and the short DNS response window are conditions the attacker cannot fully determine, although the mitigations can be bypassed.\nPR:N - icmp_rcv() checks packet structure, checksum, and policy but has no authentication or capability gate; icmp_unreach() passes a valid Fragmentation Needed quote to udp_err() without verifying that its sender is an on-path router.\nUI:N - The attacker can induce a resolver's connected UDP socket with a DNS query and then send the ICMP probes and cache-verification traffic; no victim user action is required.\nS:U - The FNHE oracle in udp_err() compromises networking and application data governed by the same host security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The __udp4_lib_lookup() result controls whether ipv4_sk_update_pmtu() or ipv4_sk_redirect() leaves an observable FNHE, disclosing the complete ephemeral source port. On a recursive DNS resolver, removing that entropy enables cache poisoning and redirection of client traffic, permitting broad disclosure.\nI:H - After learning the port, the same attacker can forge UDP DNS replies and brute-force the remaining transaction ID; an accepted reply can poison the resolver cache and map chosen names to attacker-controlled addresses.\nA:N - The fixed defect is the match-dependent FNHE oracle, not memory corruption or a crash. update_or_create_fnhe() already accepts other minimally validated ICMP cases, and the fix deliberately preserves exception creation, so route-cache manipulation is not an availability impact removed by this patch."
            }
          ]
        }
      ],
      "affected": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
              "lessThan": "ecd7ead4bf05e221e90f18a29aec570a50fd1592",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
              "lessThan": "be4fd05398f2b5e42029be70ee875fc749b8ce3a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4895c771c7f006b4b90f9d6b1d2210939ba57b38",
              "lessThan": "4c3499f79f8c7e8561266bcc220a18538cec0458",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/ipv4/udp.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.59",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/ipv4/udp.c"
          ],
          "defaultStatus": "affected"
        }
      ],
      "modified": "2026-10-26T15:13:01.358Z",
      "provider": "cve",
      "references": [
        "https://git.kernel.org/stable/c/ecd7ead4bf05e221e90f18a29aec570a50fd1592",
        "https://git.kernel.org/stable/c/be4fd05398f2b5e42029be70ee875fc749b8ce3a",
        "https://git.kernel.org/stable/c/4c3499f79f8c7e8561266bcc220a18538cec0458"
      ],
      "provider_metadata": {
        "cna": {
          "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "shortName": "Linux",
          "dateUpdated": "2026-10-26T15:13:01.358Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-99077",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/containers/cna/metrics"
  },
  "source_id": "core-cve",
  "document_id": 314031,
  "published_at": "2026-10-23T12:23:22.773+00:00"
}