---
id: CVE-2026-99064
title: 'cipso: adjust cached option offsets when removing CIPSO'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cipso: adjust cached option offsets when removing CIPSO

  cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust
  cached offsets for options that follow th…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 89aa3619d141d6cfb6040a561aebb6d99d3e2285 <
    b965977126a90e01825814c859ba4788691eddd3
  - >-
    Linux >= 89aa3619d141d6cfb6040a561aebb6d99d3e2285 <
    2200fe1d6148b78e1b8f00f4b2bd47760015077f
  - >-
    Linux >= 89aa3619d141d6cfb6040a561aebb6d99d3e2285 <
    6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0
  - >-
    Linux >= 89aa3619d141d6cfb6040a561aebb6d99d3e2285 <
    6d25ffca055a77787c21a36b66c253f76239411b
  - Linux 6.10
published: '2026-10-23'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:10:17.979Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99064'
references:
  - url: 'https://git.kernel.org/stable/c/b965977126a90e01825814c859ba4788691eddd3'
  - url: 'https://git.kernel.org/stable/c/2200fe1d6148b78e1b8f00f4b2bd47760015077f'
  - url: 'https://git.kernel.org/stable/c/6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0'
  - url: 'https://git.kernel.org/stable/c/6d25ffca055a77787c21a36b66c253f76239411b'
tags:
  - cve.org
epss: 0.00209
epssPercentile: 0.10495
ingestedAt: '2026-10-23T13:24:55.518Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cipso: adjust cached option offsets when removing CIPSO

cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust
cached offsets for options that follow them.

For example, with a valid 10-byte CIPSO option followed by a seven-byte
RR option, parsing records rr at offset 30.  Removing CIPSO moves RR to
offset 20, while the cached offset remains 30.  Consumers such as
ip_forward_options() and __ip_options_echo() then access the wrong bytes;
the latter may interpret packet data as the option length and copy it into
fixed-size option storage.

Mirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and
router_alert offsets when they follow CIPSO.  cipso_len is the distance
the first memmove() shifts those options.  The later header move and
network-header reset relocate the bytes and their offset base together.

## Affected

- `Linux >= 89aa3619d141d6cfb6040a561aebb6d99d3e2285 < b965977126a90e01825814c859ba4788691eddd3`
- `Linux >= 89aa3619d141d6cfb6040a561aebb6d99d3e2285 < 2200fe1d6148b78e1b8f00f4b2bd47760015077f`
- `Linux >= 89aa3619d141d6cfb6040a561aebb6d99d3e2285 < 6e49d611a9cfbaac927b8fa80ebd4f6b1f37ada0`
- `Linux >= 89aa3619d141d6cfb6040a561aebb6d99d3e2285 < 6d25ffca055a77787c21a36b66c253f76239411b`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.