Homepage

CVE-2026-99030 Affecting kernel-livepatch-6.12.113-138.209 package, versions <1:1.0-0.amzn2023

Severity

 Recommended
high

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.46% (40th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN2023-KERNELLIVEPATCH612113138209-21812297
  • published29 Oct 2026
  • disclosed23 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 23 Oct 2026

NewCVE-2026-99030  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2023 kernel-livepatch-6.12.113-138.209 to version 1:1.0-0.amzn2023 or higher.
This issue was patched in ALAS2023-2026-3335.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-livepatch-6.12.113-138.209 package and not the kernel-livepatch-6.12.113-138.209 package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy into a buffer that is about to go out on the wire: an ICMP error quoting the offending packet, or a driver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer is zeroed beforehand, so whatever was in memory there gets sent.

Zero the part of the buffer we didn't fill. The checksum usually won't match the data any more, so the receiver will usually drop the packet, but either way it no longer carries anything it shouldn't. Only zero for a positive @len, a negative one from a broken caller must not turn into a huge memset().