AZL-112868: CVE-2026-99284 affecting package kernel 6.6.161.1-1

Q: Who is realistically exposed to this issue?

Systems using the affected Azure Linux kernel package are exposed when traffic can traverse the described nfnetlink_queue or Open vSwitch upcall paths and then be processed by ESP input. The impact described is an unprivileged user modifying page-cache contents for a root-owned read-only file.

Q: What conditions are required for exploitation?

An attacker needs a path that causes skb_zerocopy() to build an skb for nfnetlink_queue or an Open vSwitch upcall using page-cache-backed fragments. ESP input must then process that skb and incorrectly skip skb_cow_data() because the shared-fragment marker was not propagated.

Q: How can I determine whether a system may be affected?

Check whether the system is running the Azure Linux kernel package version 6.6.161.1-1 identified in the advisory. Also determine whether the host uses nfnetlink_queue or Open vSwitch upcalls in traffic paths that are subject to ESP processing.

Published Nov 7, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: propagate shared-frag marker in skbzerocopy()

skbzerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skbshinfo(from)->flags into skbshinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skbhassharedfrag() as false.

That breaks the invariant relied on by later in-place writers. ESP input checks skbhassharedfrag() before deciding whether an uncloned nonlinear skb can skip skbcowdata(); with the marker lost, an skb that skbzerocopy() built for nfnetlinkqueue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file.

Propagate SKBFLSHAREDFRAG when frag descriptors are copied, as done for the other frag-transfer helpers.

Affected Software

1 affected component

azure-linux/kernel<=6.6.161.1-1

Event History

Nov 7, 2026

Advisory Published

via OSV·09:17 PM

Data Sourced

via OSV·09:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-99284

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems using the affected Azure Linux kernel package are exposed when traffic can traverse the described nfnetlink_queue or Open vSwitch upcall paths and then be processed by ESP input. The impact described is an unprivileged user modifying page-cache contents for a root-owned read-only file.

What conditions are required for exploitation?

An attacker needs a path that causes skb_zerocopy() to build an skb for nfnetlink_queue or an Open vSwitch upcall using page-cache-backed fragments. ESP input must then process that skb and incorrectly skip skb_cow_data() because the shared-fragment marker was not propagated.

How can I determine whether a system may be affected?

Check whether the system is running the Azure Linux kernel package version 6.6.161.1-1 identified in the advisory. Also determine whether the host uses nfnetlink_queue or Open vSwitch upcalls in traffic paths that are subject to ESP processing.

AZL-112868: CVE-2026-99284 affecting package kernel 6.6.161.1-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who is realistically exposed to this issue?

What conditions are required for exploitation?

How can I determine whether a system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What conditions are required for exploitation?

How can I determine whether a system may be affected?