{"id":"CVE-2026-99055","kind":"vulnerability","aliases":["CVE-2026-99055"],"related":[],"title":"Linux kernel: TCP zerocopy receive can crash on device-memory fragments","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: reject net_iov in zerocopy receive mapping hints\n\nAfter copying a readable prefix, receive_fallback_to_copy() asks\ntcp_zerocopy_set_hint_for_skb() where page mapping can resume. If the\nnext skb is unreadable, find_next_mappable_frag() passes its net_iov\nfragment to can_map_frag().\n\nskb_frag_page() returns NULL for a net_iov, but can_map_frag()\ndereferences it in PageCompound(). A v7.2 KASAN run on a connected TCP\nsocket with 64 readable bytes followed by a 4096-byte NET_IOV_DMABUF\nfragment reported:\n\n  BUG: KASAN: null-ptr-deref in can_map_frag\n  tcp_zerocopy_receive -> can_map_frag\n  Kernel panic - not syncing: KASAN: panic_on_warn set\n\nThe diagnostic inserted the net_iov directly because the test host has\nno devmem-capable NIC. Hardware end-to-end reachability remains untested\nand requires CONFIG_NET_DEVMEM plus a supported DMA-buf-bound RX queue.\n\nReject all net_iov fragments before skb_frag_page(). This covers both\nDMABUF and IOURING net_iov types while leaving page-backed checks\nunchanged. With the guard, the same queue copied the readable prefix,\nreturned a 4096-byte skip hint, and completed without a fault.","summary":"In the Linux kernel's TCP zerocopy receive path, a socket that reads a readable prefix followed by an unreadable device-memory (net_iov) fragment dereferences a null page pointer, causing a kernel crash. The sources describe a denial of service (kernel panic) observed under KASAN; they do not describe code execution.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","network-stack","self-hosted","tcp"],"not_affected_if":["default-config"],"how_to_check":"- Check whether the kernel is built with `CONFIG_NET_DEVMEM` enabled, for example `grep CONFIG_NET_DEVMEM /boot/config-$(uname -r)`\n- Check the running kernel version with `uname -r` and compare it to the fixed release in the kernel stable tree (unknown from the sources)\n- Check whether the host uses devmem TCP or DMA-buf bound RX queues, which the sources say are required for reachability","fix":"- Update the Linux kernel to a stable release that includes the commit 'tcp: reject net_iov in zerocopy receive mapping hints' (fixed version unknown from the sources)\n- Hosts without `CONFIG_NET_DEVMEM` or without DMA-buf bound RX queues are not affected by the sources' description","status":"open","published_at":"2026-10-23T13:17:29+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:01+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:54:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes the commit 'tcp: reject net_iov in zerocopy receive mapping hints' (fixed version unknown from the sources)\n- Hosts without `CONFIG_NET_DEVMEM` or without DMA-buf bound RX queues are not affected by the sources' description","reach":"network","title":"Linux kernel: TCP zerocopy receive can crash on device-memory fragments","impact":"medium","summary":"In the Linux kernel's TCP zerocopy receive path, a socket that reads a readable prefix followed by an unreadable device-memory (net_iov) fragment dereferences a null page pointer, causing a kernel crash. The sources describe a denial of service (kernel panic) observed under KASAN; they do not describe code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","tcp","self-hosted","network-stack"],"confidence":0.6,"needs_auth":"unknown","worst_case":"kernel panic crashes the host","analyst_note":"Confirm the fixed kernel versions and stable commit from the NVD entry or kernel.org stable tree; severity is not given by the sources.","how_to_check":"- Check whether the kernel is built with `CONFIG_NET_DEVMEM` enabled, for example `grep CONFIG_NET_DEVMEM /boot/config-$(uname -r)`\n- Check the running kernel version with `uname -r` and compare it to the fixed release in the kernel stable tree (unknown from the sources)\n- Check whether the host uses devmem TCP or DMA-buf bound RX queues, which the sources say are required for reachability","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"The sources say the bug needs CONFIG_NET_DEVMEM and a supported DMA-buf-bound RX queue, so hosts using devmem TCP receive are the ones to look at. Hardware reachability was not tested by the reporter. Teams running standard kernels without devmem can likely skip it, but the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000751,"input_tokens":3723,"output_tokens":758,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99055':15A,18A '4096':174C,282C '64':168C 'ask':110C 'back':267C 'bound':242C 'buf':241C 'bug':181C 'byte':170C,175C,283C 'capabl':221C 'caus':60B 'check':268C 'code':80B 'complet':287C 'config':233C 'connect':164C 'copi':102C,109C,276C 'cover':255C 'crash':7A,63B 'cve':13A,16A 'denial':68B 'deref':186C 'derefer':55B,154C 'describ':66B,79B 'devic':10A,50B 'device-memori':9A,49B 'devmem':220C,235C 'devmem-cap':219C 'diagnost':207C 'direct':212C 'dma':240C 'dma-buf-bound':239C 'dmabuf':178C,257C 'end':225C,227C 'end-to-end':224C 'execut':81B 'fallback':107C 'fault':290C 'find':128C 'follow':45B,87C,171C 'frag':131C,140C,142C,153C,190C,196C,252C 'fragment':12A,54B,136C,179C,249C 'guard':272C 'hardwar':223C 'hint':100C,114C,285C 'host':27B,216C 'infrastructur':19B 'insert':208C 'iour':259C 'iov':53B,95C,135C,149C,177C,211C,248C,261C 'kasan':75B,160C,182C,201C 'kernel':2A,20B,32B,62B,71B,85C,197C 'leav':264C 'linux':1A,21B,31B,84C 'map':99C,119C,139C,152C,189C,195C 'mappabl':130C 'memori':11A,51B 'net':52B,94C,134C,148C,176C,210C,234C,247C,260C 'network':23B 'network-stack':22B 'next':124C,129C 'nic':222C 'null':57B,145C,184C 'null-ptr-deref':183C 'observ':73B 'page':58B,118C,143C,253C,266C 'page-back':265C 'pagecompound':157C 'panic':72B,198C,202C 'pass':132C 'path':37B 'plus':236C 'pointer':59B 'prefix':44B,105C,279C 'ptr':185C 'queue':244C,275C 'reachabl':228C 'read':41B 'readabl':43B,104C,169C,278C 'receiv':5A,36B,98C,106C,193C 'reject':93C,245C 'remain':229C 'report':180C 'requir':232C 'resolv':91C 'resum':121C 'return':144C,280C 'run':161C 'rx':243C 'self':26B 'self-host':25B 'servic':70B 'set':113C,205C 'skb':116C,125C,141C,251C 'skip':284C 'socket':39B,166C 'sourc':65B 'stack':24B 'support':238C 'sync':200C 'tcp':3A,28B,34B,92C,111C,165C,191C 'test':215C 'type':262C 'unchang':269C 'unread':48B,127C 'untest':230C 'v7.2':159C 'vulner':88C 'warn':204C 'without':288C 'zerocopi':4A,35B,97C,112C,192C","nicknames":[],"mitigations":[],"who_affected":"The sources say the bug needs CONFIG_NET_DEVMEM and a supported DMA-buf-bound RX queue, so hosts using devmem TCP receive are the ones to look at. Hardware reachability was not tested by the reporter. Teams running standard kernels without devmem can likely skip it, but the sources do not state this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99055","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99055","severity":null,"published_at":"2026-10-23T13:17:29+00:00","modified_at":"2026-10-23T13:17:29+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99055","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99055","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}