CVE record · CVE-2026-99112

net/sched: cls_flower: validate mask pointer after nla_next()

CVSS 7.1 HighEPSS 0.0013 · 2nd percentile

Published by the CVE Program (CNA: Linux) at 28 Oct 2026, 10:34 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected 238b5ebdb6a6e4bc90810b9f8ec0063b3dfda41a to before a9283d006eef7e3b56f0f279a49bb63f6e5e61df git affected c96adff95619178e2118925578343ad54857c80c to before 497944d534ffb1be300365523030c7c6517cbbb6 git affected c96adff95619178e2118925578343ad54857c80c to before a55d84907337580d91c0d54779d9d4b934633158 git affected c96adff95619178e2118925578343ad54857c80c to before cff9bf34afde46c238189cc6f7690b7e35225df1 git affected c96adff95619178e2118925578343ad54857c80c to before 35354bf67aa0f7bace66ffb614906124ed50d59d git affected c96adff95619178e2118925578343ad54857c80c to before 45e60747a9db2307929260d9aa9c1c6cbb70ee77 git affected c96adff95619178e2118925578343ad54857c80c to before bb187146c7e5c666874784e4f3fc1bc5126e6e92 git affected c96adff95619178e2118925578343ad54857c80c to before fee10655709c5c597e8e9f722f3035d9ea31ff3a git affected 5.10.11 to before 5.10.273 semver Other versions: unaffected
Linux	Linux	affected 5.11 unaffected before 5.11 semver unaffected 5.10.273 to 5.10., inclusive semver unaffected 5.15.224 to 5.15., inclusive semver unaffected 6.1.191 to 6.1., inclusive semver unaffected 6.6.161 to 6.6., inclusive semver unaffected 6.12.115 to 6.12., inclusive semver unaffected 6.18.59 to 6.18., inclusive semver unaffected 7.2.13 to 7.2., inclusive semver unaffected 7.3 to , inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-99112
CNA: Linux
Tags: Linux kernel
Published: 28 Oct 2026
Updated: 31 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.1	High	3.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	CNA (Linux)

CISA KEV Not listed.
EPSS 0.0013, the 2nd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

28 Oct 2026, 10:34 UTC Confirmed by the CVE List

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.