{"id":"CVE-2026-99284","kind":"vulnerability","aliases":["CVE-2026-99284"],"related":[],"title":"Linux kernel: lost shared-fragment marker lets unprivileged users write read-only files","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker in skb_zerocopy()\n\nskb_zerocopy() moves frag descriptors from @from into @to and takes a\nreference on each frag, but it does not copy skb_shinfo(from)->flags into\nskb_shinfo(to)->flags.  A destination skb holding the same page-cache\nbacked frags as the source therefore reports skb_has_shared_frag() as\nfalse.\n\nThat breaks the invariant relied on by later in-place writers.  ESP input\nchecks skb_has_shared_frag() before deciding whether an uncloned\nnonlinear skb can skip skb_cow_data(); with the marker lost, an skb that\nskb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is\ndecrypted in place, letting an unprivileged user write into the page\ncache of a root-owned read-only file.\n\nPropagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for\nthe other frag-transfer helpers.","summary":"In the Linux kernel's network stack, a zero-copy helper drops a flag that marks page-cache-backed fragments as shared, so ESP decryption can run in place on them. An unprivileged local user can then write into the page cache of a root-owned read-only file.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ipsec","linux-kernel","nfnetlink-queue","openvswitch","runtime"],"not_affected_if":["no-ipsec-esp","no-nfqueue-or-ovs-upcall"],"how_to_check":"Run uname -r and check your distro's kernel changelog for CVE-2026-99284 or commit 79dc34beb1fd. You are exposed only if the host processes IPsec ESP (check 'ip xfrm state') and also uses nfnetlink_queue (nft/iptables 'queue' rules) or Open vSwitch upcalls (ovs-vsctl show).","fix":"Apply upstream commit 79dc34beb1fd (net: skbuff: propagate shared-frag marker in skb_zerocopy()); it is queued for 6.18-stable. Move to the distro kernel that lists CVE-2026-99284. Stable release numbers unknown until the stable release notes are published.","status":"open","published_at":"2026-11-07T21:17:00+00:00","first_seen_at":"2026-11-07T21:18:43+00:00","triaged_at":"2026-11-07T21:20:04+00:00","updated_at":"2026-11-07T21:20:51+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-07T21:20:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: lost shared-fragment marker lets unprivileged users write read-only files","impact":"high","summary":"In the Linux kernel's network stack, a zero-copy helper drops a flag that marks page-cache-backed fragments as shared, so ESP decryption can run in place on them. An unprivileged local user can then write into the page cache of a root-owned read-only file.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ipsec","nfnetlink-queue","openvswitch"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user writes into read-only root-owned file page cache","analyst_note":"Find affected and fixed kernel version ranges and the upstream commit for the skb_zerocopy() fix in NVD or kernel.org.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-ipsec-esp","no-nfqueue-or-ovs-upcall"],"who_is_affected":"Linux systems running a kernel with the skb_zerocopy() change that drops the shared-fragment flag, where IPsec ESP traffic is processed and the skb is passed through nfnetlink_queue or Open vSwitch upcalls. The sources do not list affected kernel version ranges. Systems without IPsec ESP or those paths can likely skip it, but the sources do not say.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4480,"output_tokens":545,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find affected and fixed kernel version ranges and the upstream commit for the skb_zerocopy() fix in NVD or kernel.org.","search":"'-2026':17A,20A '-99284':18A,21A 'back':51B,143C 'break':157C 'built':196C 'cach':50B,74B,142C,217C 'check':170C 'copi':41B,124C,235C 'cow':185C 'cve':16A,19A 'data':186C 'decid':176C 'decrypt':57B,206C 'descriptor':108C,233C 'destin':135C 'done':237C 'drop':43B 'esp':56B,168C 'fals':155C 'file':15A,83B,226C 'flag':45B,128C,133C 'follow':89C 'frag':99C,107C,119C,144C,153C,174C,230C,232C,242C 'frag-transf':241C 'fragment':6A,52B 'helper':42B,244C 'hold':137C 'in-plac':164C 'input':169C 'invari':159C 'ipsec':22B 'kernel':2A,25B,34B,87C 'later':163C 'let':8A,209C 'linux':1A,24B,33B,86C 'linux-kernel':23B 'local':66B 'lost':3A,190C 'mark':47B 'marker':7A,100C,189C 'move':106C 'net':94C 'network':36B 'nfnetlink':27B,198C 'nfnetlink-queu':26B 'nonlinear':180C 'openvswitch':29B,203C 'own':79B,222C 'page':49B,73B,141C,216C 'page-cach':140C 'page-cache-back':48B 'place':61B,166C,208C 'propag':96C,227C 'queue':28B,199C 'read':13A,81B,224C 'read-on':12A,80B,223C 'refer':116C 'reli':160C 'report':149C 'resolv':93C 'root':78B,221C 'root-own':77B,220C 'run':59B 'runtim':30B 'share':5A,54B,98C,152C,173C,229C 'shared-frag':4A,97C 'shinfo':126C,131C 'skb':102C,104C,125C,130C,136C,150C,171C,181C,184C,192C,194C 'skbfl':228C 'skbuff':95C 'skip':183C 'sourc':147C 'stack':37B 'take':114C 'therefor':148C 'transfer':243C 'unclon':179C 'unprivileg':9A,65B,211C 'upcal':204C 'user':10A,67B,212C 'vulner':90C 'whether':177C 'write':11A,70B,213C 'writer':167C 'zero':40B 'zero-copi':39B 'zerocopi':103C,105C,195C","nicknames":[],"mitigations":[],"who_affected":"Linux hosts that terminate IPsec ESP and also send packets to userspace through nfnetlink_queue (NFQUEUE rules, e.g. IPS/IDS) or through Open vSwitch upcalls. A local unprivileged user can then write into the page cache of a root-owned read-only file. Hosts without IPsec ESP, or without NFQUEUE and OVS upcall paths, can likely skip it. Affected kernel version ranges are not stated in the sources read.","tier":"B","verified":{"fix":{"at":"2026-11-07T21:20:51Z","by":"analyst","doc":"https://ci.syzbot.org/series/530f70c1-b89b-4aea-9f60-b37ea51b8ceb/all_patches","run_id":2147}},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","ipsec","linuxkernel","nfnetlinkqueue","openvswitch","runtime"],"campaign_type":null,"search_a":"'-2026':17A,20A '-99284':18A,21A 'cve':16A,19A 'file':15A 'fragment':6A 'kernel':2A 'let':8A 'linux':1A 'lost':3A 'marker':7A 'read':13A 'read-on':12A 'share':5A 'shared-frag':4A 'unprivileg':9A 'user':10A 'write':11A","search_b":"'back':51B 'cach':50B,74B 'copi':41B 'decrypt':57B 'drop':43B 'esp':56B 'file':83B 'flag':45B 'fragment':52B 'helper':42B 'ipsec':22B 'kernel':25B,34B 'linux':24B,33B 'linux-kernel':23B 'local':66B 'mark':47B 'network':36B 'nfnetlink':27B 'nfnetlink-queu':26B 'openvswitch':29B 'own':79B 'page':49B,73B 'page-cache-back':48B 'place':61B 'queue':28B 'read':81B 'read-on':80B 'root':78B 'root-own':77B 'run':59B 'runtim':30B 'share':54B 'stack':37B 'unprivileg':65B 'user':67B 'write':70B 'zero':40B 'zero-copi':39B","search_c":"'back':143C 'break':157C 'built':196C 'cach':142C,217C 'check':170C 'copi':124C,235C 'cow':185C 'data':186C 'decid':176C 'decrypt':206C 'descriptor':108C,233C 'destin':135C 'done':237C 'esp':168C 'fals':155C 'file':226C 'flag':128C,133C 'follow':89C 'frag':99C,107C,119C,144C,153C,174C,230C,232C,242C 'frag-transf':241C 'helper':244C 'hold':137C 'in-plac':164C 'input':169C 'invari':159C 'kernel':87C 'later':163C 'let':209C 'linux':86C 'lost':190C 'marker':100C,189C 'move':106C 'net':94C 'nfnetlink':198C 'nonlinear':180C 'openvswitch':203C 'own':222C 'page':141C,216C 'page-cach':140C 'place':166C,208C 'propag':96C,227C 'queue':199C 'read':224C 'read-on':223C 'refer':116C 'reli':160C 'report':149C 'resolv':93C 'root':221C 'root-own':220C 'share':98C,152C,173C,229C 'shared-frag':97C 'shinfo':126C,131C 'skb':102C,104C,125C,130C,136C,150C,171C,181C,184C,192C,194C 'skbfl':228C 'skbuff':95C 'skip':183C 'sourc':147C 'take':114C 'therefor':148C 'transfer':243C 'unclon':179C 'unprivileg':211C 'upcal':204C 'user':212C 'vulner':90C 'whether':177C 'write':213C 'writer':167C 'zerocopi':103C,105C,195C","first_public_at":"2026-11-07T21:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99284","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99284","severity":null,"published_at":"2026-11-07T21:17:00+00:00","modified_at":"2026-11-07T21:17:00+00:00","first_seen_at":"2026-11-07T21:18:43+00:00","fetched_at":"2026-11-07T21:18:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-99284:2147","url":"https://lists.openwall.net/netdev/2026/10/22/204","severity":null,"published_at":"2026-11-07T21:20:51+00:00","modified_at":"2026-11-07T21:20:51+00:00","first_seen_at":"2026-11-07T21:20:51+00:00","fetched_at":"2026-11-07T21:20:51+00:00","note":"Read the upstream netdev patch, Kicinski's bot reply (applied to net.git as 79dc34beb1fd) and the 6.18-stable review backport. Fixed stable release numbers not found: the stable page is a review patch only. NVD page was empty. Bug was introduced by skb_zerocopy() (af2806f8f90a) and became exploitable via ESP (f4c50a4034e6). Sibling Fragnesia CVE-2026-46300 fixes the same marker in other helpers.","cites":["https://lists.openwall.net/netdev/2026/10/22/204","https://lists.openwall.net/netdev/2026/10/23/353","https://ci.syzbot.org/series/530f70c1-b89b-4aea-9f60-b37ea51b8ceb/all_patches"]}],"documents":[{"id":98028,"url":"https://lists.openwall.net/netdev/2026/10/22/204","title":"[PATCH v2 net] net: skbuff: propagate shared-frag marker in skb_zerocopy()","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":98029,"url":"https://lists.openwall.net/netdev/2026/10/23/353","title":"netdev bot: patch applied to net.git as 79dc34beb1fd","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":98030,"url":"https://ci.syzbot.org/series/530f70c1-b89b-4aea-9f60-b37ea51b8ceb/all_patches","title":"6.18-stable review patch of 79dc34beb1fd","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}