{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.11-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  cipso: adjust cached option offsets when removing CIPSO  cipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust cached offsets for options that follow them.  For example, with a valid 10-byte CIPSO option followed by a seven-byte RR option, parsing records rr at offset 30.  Removing CIPSO moves RR to offset 20, while the cached offset remains 30.  Consumers such as ip_forward_options() and __ip_options_echo() then access the wrong bytes; the latter may interpret packet data as the option length and copy it into fixed-size option storage.  Mirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and router_alert offsets when they follow CIPSO.  cipso_len is the distance the first memmove() shifts those options.  The later header move and network-header reset relocate the bytes and their offset base together.",
  "id": "DEBIAN-CVE-2026-99064",
  "modified": "2026-10-25T09:47:28.428284350Z",
  "published": "2026-10-23T13:17:30.253Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99064"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-99064"
  ]
}