---
id: "CVE-2026-99284"
page: "https://infrastack.ai/live/CVE-2026-99284"
kind: "vulnerability"
aliases: ["CVE-2026-99284"]
title: "Linux kernel: lost shared-fragment marker lets unprivileged users write read-only files"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ipsec", "linux-kernel", "nfnetlink-queue", "openvswitch", "runtime"]
not_affected_if: ["no-ipsec-esp", "no-nfqueue-or-ovs-upcall"]
published_at: "2026-11-07T21:17:00+00:00"
first_seen_at: "2026-11-07T21:18:43+00:00"
updated_at: "2026-11-07T21:20:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99284", "first_seen_at": "2026-11-07T21:18:43+00:00"}, {"source": "analyst", "url": "https://lists.openwall.net/netdev/2026/10/22/204", "first_seen_at": "2026-11-07T21:20:51+00:00", "cites": ["https://lists.openwall.net/netdev/2026/10/22/204", "https://lists.openwall.net/netdev/2026/10/23/353", "https://ci.syzbot.org/series/530f70c1-b89b-4aea-9f60-b37ea51b8ceb/all_patches"]}]
exploit_sources: []
---

# Linux kernel: lost shared-fragment marker lets unprivileged users write read-only files

Link for people: https://infrastack.ai/live/CVE-2026-99284 (this .md is for agents)

In the Linux kernel's network stack, a zero-copy helper drops a flag that marks page-cache-backed fragments as shared, so ESP decryption can run in place on them. An unprivileged local user can then write into the page cache of a root-owned read-only file.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Run uname -r and check your distro's kernel changelog for CVE-2026-99284 or commit 79dc34beb1fd. You are exposed only if the host processes IPsec ESP (check 'ip xfrm state') and also uses nfnetlink_queue (nft/iptables 'queue' rules) or Open vSwitch upcalls (ovs-vsctl show).

## Fix

Apply upstream commit 79dc34beb1fd (net: skbuff: propagate shared-frag marker in skb_zerocopy()); it is queued for 6.18-stable. Move to the distro kernel that lists CVE-2026-99284. Stable release numbers unknown until the stable release notes are published.

## Timeline

- 2026-11-07T21:18:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99284
- 2026-11-07T21:20:51+00:00 analyst https://lists.openwall.net/netdev/2026/10/22/204 — Read the upstream netdev patch, Kicinski's bot reply (applied to net.git as 79dc34beb1fd) and the 6.18-stable review backport. Fixed stable release numbers not found: the stable page is a review patch only. NVD page was empty. Bug was introduced by skb_zerocopy() (af2806f8f90a) and became exploitable via ESP (f4c50a4034e6). Sibling Fragnesia CVE-2026-46300 fixes the same marker in other helpers.

## Documents

- [advisory] [PATCH v2 net] net: skbuff: propagate shared-frag marker in skb_zerocopy() https://lists.openwall.net/netdev/2026/10/22/204
- [fix] netdev bot: patch applied to net.git as 79dc34beb1fd https://lists.openwall.net/netdev/2026/10/23/353
- [fix] 6.18-stable review patch of 79dc34beb1fd https://ci.syzbot.org/series/530f70c1-b89b-4aea-9f60-b37ea51b8ceb/all_patches

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: propagate shared-frag marker in skb_zerocopy()

skb_zerocopy() moves frag descriptors from @from into @to and takes a
reference on each frag, but it does not copy skb_shinfo(from)->flags into
skb_shinfo(to)->flags.  A destination skb holding the same page-cache
backed frags as the source therefore reports skb_has_shared_frag() as
false.

That breaks the invariant relied on by later in-place writers.  ESP input
checks skb_has_shared_frag() before deciding whether an uncloned
nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that
skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is
decrypted in place, letting an unprivileged user write into the page
cache of a root-owned read-only file.

Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for
the other frag-transfer helpers.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_