CVE-2026-99284 · Runtime
NO FIX YET · SEE WHAT TO DO
In the Linux kernel's network stack, a zero-copy helper drops a flag that marks page-cache-backed fragments as shared, so ESP decryption can run in place on them. An unprivileged local user can then write into the page cache of a root-owned read-only file.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Linux hosts that terminate IPsec ESP and also send packets to userspace through nfnetlink_queue (NFQUEUE rules, e.g. IPS/IDS) or through Open vSwitch upcalls. A local unprivileged user can then write into the page cache of a root-owned read-only file. Hosts without IPsec ESP, or without NFQUEUE and OVS upcall paths, can likely skip it. Affected kernel version ranges are not stated in the sources read.
Not affected if no-ipsec-esp, no-nfqueue-or-ovs-upcall
Who cares ipsec, linux-kernel, nfnetlink-queue, openvswitch
ip xfrm state) and also uses nfnetlink_queue (nft/iptables queue rules) or Open vSwitch upcalls (ovs-vsctl show)In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: propagate shared-frag marker in skb_zerocopy()
skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)->flags into skb_shinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skb_has_shared_frag() as false.
That breaks the invariant relied on by later in-place writers. ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file.
Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for the other frag-transfer helpers.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.