CVE-2026-99999, disclosed on 15 October, affects the Linux kernel’s IPv4 networking subsystem. Ubuntu lists a CVSS score of 9.3 (Critical). Malformed packet checksum metadata can cause memory corruption, potentially allowing host crashes, information disclosure, or code execution. Ubuntu advisory · Red Hat technical assessment
Affected platforms and services requiring attention:
• Amazon Linux–based workloads: Amazon Linux 2 and 2023 kernel packages are listed as affected, with fixes pending in the published advisory. AWS evidence
• RHEL-hosted services: Red Hat confirms affected RHEL kernel and kernel-rt packages. Applications running on vulnerable hosts may be disrupted if the host crashes. Red Hat evidence
• Virtual machines and sandbox workloads: Red Hat identifies an untrusted guest VM as a possible attack source against an affected host, creating potential impact across workloads sharing that host. Technical evidence
Network availability: No internal monitoring or host inventory was supplied, so specific outages or compromised services are unconfirmed. Web/API, DNS, VPN, and database services should be assessed where they run on affected hosts.
Recommended response: Identify affected kernel packages, follow vendor patch guidance, and verify the fixed kernel is running after any required reboot. Vendor scores differ: AWS and Red Hat rate this vulnerability 8.8.
Monday, October 19, 2026
