UBUNTU-CVE-2026-99284: Medium severity ubuntu/linux vulnerability

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skbzerocopy() skbzerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skbshinfo(from)->flags into skbshinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skbhassharedfrag() as false. That breaks the invariant relied on by later in-place writers. ESP input checks skbhassharedfrag() before deciding whether an uncloned nonlinear skb can skip skbcowdata(); with the marker lost, an skb that skbzerocopy() built for nfnetlinkqueue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file. Propagate SKBFLSHAREDFRAG when frag descriptors are copied, as done for the other frag-transfer helpers.