CVE-2026-99284: net: skbuff: propagate shared-frag marker in skb_zerocopy()

Published Nov 7, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: propagate shared-frag marker in skbzerocopy()

skbzerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skbshinfo(from)->flags into skbshinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skbhassharedfrag() as false.

That breaks the invariant relied on by later in-place writers. ESP input checks skbhassharedfrag() before deciding whether an uncloned nonlinear skb can skip skbcowdata(); with the marker lost, an skb that skbzerocopy() built for nfnetlinkqueue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file.

Propagate SKBFLSHAREDFRAG when frag descriptors are copied, as done for the other frag-transfer helpers.

Event History

Nov 7, 2026

CVE Published

via MITRE·08:40 PM

Data Sourced

via MITRE·08:40 PM

Description

Data Sourced

via NVD·09:17 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Exposure requires a Linux kernel path where skb_zerocopy() builds an skb containing page-cache-backed fragments and that skb is later processed by ESP input. The description specifically identifies nfnetlink_queue and Open vSwitch upcalls as paths that can create the affected skb.

What does an attacker need to exploit it?

The vulnerable flow can allow an unprivileged user to modify the page cache for a root-owned read-only file. Exploitation depends on reaching the affected skb_zerocopy(), packet-processing, and ESP decryption path; the provided data does not specify further prerequisites.

What is the security impact if exploitation succeeds?

An in-place ESP decryption operation can write into page-cache-backed fragments that were incorrectly treated as unshared. This can give an unprivileged user write access to the page cache of a root-owned read-only file.

What mitigation is available if the kernel update cannot be applied immediately?

The provided information does not identify a configuration-only workaround. Reducing exposure would require avoiding the affected packet paths involving nfnetlink_queue or Open vSwitch upcalls together with ESP input, where operationally feasible.

CVE-2026-99284: net: skbuff: propagate shared-frag marker in skb_zerocopy()

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

What is the security impact if exploitation succeeds?

What mitigation is available if the kernel update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

What is the security impact if exploitation succeeds?

What mitigation is available if the kernel update cannot be applied immediately?