Live › vulnerability › CVE-2026-99055
Go to dashboardIn the Linux kernel's TCP zerocopy receive path, a socket that reads a readable prefix followed by an unreadable device-memory (net_iov) fragment dereferences a null page pointer, causing a kernel crash. The sources describe a denial of service (kernel panic) observed under KASAN; they do not describe code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
The sources say the bug needs CONFIG_NET_DEVMEM and a supported DMA-buf-bound RX queue, so hosts using devmem TCP receive are the ones to look at. Hardware reachability was not tested by the reporter. Teams running standard kernels without devmem can likely skip it, but the sources do not state this explicitly.
No product ranges from the sources yet.
CONFIG_NET_DEVMEM enabled, for example grep CONFIG_NET_DEVMEM /boot/config-$(uname -r)uname -r and compare it to the fixed release in the kernel stable tree (unknown from the sources)CONFIG_NET_DEVMEM or without DMA-buf bound RX queues are not affected by the sources' descriptionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
tcp: reject net_iov in zerocopy receive mapping hints
After copying a readable prefix, receive_fallback_to_copy() asks tcp_zerocopy_set_hint_for_skb() where page mapping can resume. If the next skb is unreadable, find_next_mappable_frag() passes its net_iov fragment to can_map_frag().
skb_frag_page() returns NULL for a net_iov, but can_map_frag() dereferences it in PageCompound(). A v7.2 KASAN run on a connected TCP socket with 64 readable bytes followed by a 4096-byte NET_IOV_DMABUF fragment reported:
BUG: KASAN: null-ptr-deref in can_map_frag tcp_zerocopy_receive -> can_map_frag Kernel panic - not syncing: KASAN: panic_on_warn set
The diagnostic inserted the net_iov directly because the test host has no devmem-capable NIC. Hardware end-to-end reachability remains untested and requires CONFIG_NET_DEVMEM plus a supported DMA-buf-bound RX queue.
Reject all net_iov fragments before skb_frag_page(). This covers both DMABUF and IOURING net_iov types while leaving page-backed checks unchanged. With the guard, the same queue copied the readable prefix, returned a 4096-byte skip hint, and completed without a fault.
This page as .md · .json · in your agent: get_signal("CVE-2026-99055")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.