CVE-2026-99284

Description

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)->flags into skb_shinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skb_has_shared_frag() as false. That breaks the invariant relied on by later in-place writers. ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file. Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for the other frag-transfer helpers.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: —
CVSS score: —
CVSS vector: —
Effective score: no score available from CNA, NVD, or AI yet
CWE(s): —
Reserved: 2026-09-25
Published: 2026-11-07 20:40 UTC
Last updated: 2026-11-07 20:40 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/99xxx/CVE-2026-99284.json

AI-forensic CVSS estimate

Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.

No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-119329

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`af2806f8f90a150160be898cd85332459c83c5cb` (affected), `af2806f8f90a150160be898cd85332459c83c5cb` (affected), `af2806f8f90a150160be898cd85332459c83c5cb` (affected), `af2806f8f90a150160be898cd85332459c83c5cb` (affected)	—
Linux	Linux	`3.14` (affected), `0` (unaffected), `6.18.61` (unaffected), `7.2.15` (unaffected), `7.3.2` (unaffected), `7.4-rc1` (unaffected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-99284.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1c623e3cbf43f12dd4a72712079bfa247a9b8ba3",
              "status": "affected",
              "version": "af2806f8f90a150160be898cd85332459c83c5cb",
              "versionType": "git"
            },
            {
              "lessThan": "d7d6ff98d5d1b400f02211f962ac32cc0020aeab",
              "status": "affected",
              "version": "af2806f8f90a150160be898cd85332459c83c5cb",
              "versionType": "git"
            },
            {
              "lessThan": "1a9c180cd8435917b7516edfb1c9148032c28773",
              "status": "affected",
              "version": "af2806f8f90a150160be898cd85332459c83c5cb",
              "versionType": "git"
            },
            {
              "lessThan": "79dc34beb1fdb3da79753e51e15c68591a2561fe",
              "status": "affected",
              "version": "af2806f8f90a150160be898cd85332459c83c5cb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.4-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.15",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.2",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4-rc1",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker in skb_zerocopy()\n\nskb_zerocopy() moves frag descriptors from @from into @to and takes a\nreference on each frag, but it does not copy skb_shinfo(from)->flags into\nskb_shinfo(to)->flags.  A destination skb holding the same page-cache\nbacked frags as the source therefore reports skb_has_shared_frag() as\nfalse.\n\nThat breaks the invariant relied on by later in-place writers.  ESP input\nchecks skb_has_shared_frag() before deciding whether an uncloned\nnonlinear skb can skip skb_cow_data(); with the marker lost, an skb that\nskb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is\ndecrypted in place, letting an unprivileged user write into the page\ncache of a root-owned read-only file.\n\nPropagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for\nthe other frag-transfer helpers."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T20:40:33.661Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1c623e3cbf43f12dd4a72712079bfa247a9b8ba3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7d6ff98d5d1b400f02211f962ac32cc0020aeab"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a9c180cd8435917b7516edfb1c9148032c28773"
        },
        {
          "url": "https://git.kernel.org/stable/c/79dc34beb1fdb3da79753e51e15c68591a2561fe"
        }
      ],
      "title": "net: skbuff: propagate shared-frag marker in skb_zerocopy()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99284",
    "datePublished": "2026-11-07T20:40:33.661Z",
    "dateReserved": "2026-09-25T10:25:14.405Z",
    "dateUpdated": "2026-11-07T20:40:33.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}