CVE-2026-99284
net: skbuff: propagate shared-frag marker in skb_zerocopy()
What happened?
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: propagate shared-frag marker in skb_zerocopy()
skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)->flags into skb_shinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skb_has_shared_frag() as false.
That breaks the invariant relied on by later in-place writers. ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file.
Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for the other frag-transfer helpers.
Affected software and versions
| Software | Version information | Fixed version |
|---|---|---|
| LinuxLinux | affected: af2806f8f90a150160be898cd85332459c83c5cb to < fe8477e23dd2ee6bce231d65f2586a333b211dc0; affected: af2806f8f90a150160be898cd85332459c83c5cb to < 1c623e3cbf43f12dd4a72712079bfa247a9b8ba3; affected: af2806f8f90a150160be898cd85332459c83c5cb to < d7d6ff98d5d1b400f02211f962ac32cc0020aeab; affected: af2806f8f90a150160be898cd85332459c83c5cb to < 1a9c180cd8435917b7516edfb1c9148032c28773; affected: af2806f8f90a150160be898cd85332459c83c5cb to < 79dc34beb1fdb3da79753e51e15c68591a2561fe | See vendor advisory |
| LinuxLinux | affected: 3.14; unaffected: 0 to < 3.14; unaffected: 6.12.117 to ≤ 6.12.*; unaffected: 6.18.61 to ≤ 6.18.*; unaffected: 7.2.15 to ≤ 7.2.*; unaffected: 7.3.2 to ≤ 7.3.*; unaffected: 7.4-rc1 to ≤ * | See vendor advisory |
Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.
Is it being exploited?
This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.
How to respond
- Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
- Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
- Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.
Sources and remediation references
- https://www.cve.org/CVERecord?id=CVE-2026-99284
- https://git.kernel.org/stable/c/fe8477e23dd2ee6bce231d65f2586a333b211dc0
- https://git.kernel.org/stable/c/1c623e3cbf43f12dd4a72712079bfa247a9b8ba3
- https://git.kernel.org/stable/c/d7d6ff98d5d1b400f02211f962ac32cc0020aeab
- https://git.kernel.org/stable/c/1a9c180cd8435917b7516edfb1c9148032c28773
- https://git.kernel.org/stable/c/79dc34beb1fdb3da79753e51e15c68591a2561fe