CVE-2026-99284

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99284", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.405Z", "datePublished": "2026-11-07T20:40:33.661Z", "dateUpdated": "2026-11-10T18:15:30.724Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:15:30.724Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker in skb_zerocopy()\n\nskb_zerocopy() moves frag descriptors from @from into @to and takes a\nreference on each frag, but it does not copy skb_shinfo(from)->flags into\nskb_shinfo(to)->flags. A destination skb holding the same page-cache\nbacked frags as the source therefore reports skb_has_shared_frag() as\nfalse.\n\nThat breaks the invariant relied on by later in-place writers. ESP input\nchecks skb_has_shared_frag() before deciding whether an uncloned\nnonlinear skb can skip skb_cow_data(); with the marker lost, an skb that\nskb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is\ndecrypted in place, letting an unprivileged user write into the page\ncache of a root-owned read-only file.\n\nPropagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for\nthe other frag-transfer helpers."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skbuff.c"], "versions": [{"version": "af2806f8f90a150160be898cd85332459c83c5cb", "lessThan": "fe8477e23dd2ee6bce231d65f2586a333b211dc0", "status": "affected", "versionType": "git"}, {"version": "af2806f8f90a150160be898cd85332459c83c5cb", "lessThan": "1c623e3cbf43f12dd4a72712079bfa247a9b8ba3", "status": "affected", "versionType": "git"}, {"version": "af2806f8f90a150160be898cd85332459c83c5cb", "lessThan": "d7d6ff98d5d1b400f02211f962ac32cc0020aeab", "status": "affected", "versionType": "git"}, {"version": "af2806f8f90a150160be898cd85332459c83c5cb", "lessThan": "1a9c180cd8435917b7516edfb1c9148032c28773", "status": "affected", "versionType": "git"}, {"version": "af2806f8f90a150160be898cd85332459c83c5cb", "lessThan": "79dc34beb1fdb3da79753e51e15c68591a2561fe", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skbuff.c"], "versions": [{"version": "3.14", "status": "affected"}, {"version": "0", "lessThan": "3.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.61", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.15", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.18.61"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "7.2.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fe8477e23dd2ee6bce231d65f2586a333b211dc0"}, {"url": "https://git.kernel.org/stable/c/1c623e3cbf43f12dd4a72712079bfa247a9b8ba3"}, {"url": "https://git.kernel.org/stable/c/d7d6ff98d5d1b400f02211f962ac32cc0020aeab"}, {"url": "https://git.kernel.org/stable/c/1a9c180cd8435917b7516edfb1c9148032c28773"}, {"url": "https://git.kernel.org/stable/c/79dc34beb1fdb3da79753e51e15c68591a2561fe"}], "title": "net: skbuff: propagate shared-frag marker in skb_zerocopy()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/skbuff.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fe8477e23dd2ee6bce231d65f2586a333b211dc0", "status": "affected", "version": "af2806f8f90a150160be898cd85332459c83c5cb", "versionType": "git"}, {"lessThan": "1c623e3cbf43f12dd4a72712079bfa247a9b8ba3", "status": "affected", "version": "af2806f8f90a150160be898cd85332459c83c5cb", "versionType": "git"}, {"lessThan": "d7d6ff98d5d1b400f02211f962ac32cc0020aeab", "status": "affected", "version": "af2806f8f90a150160be898cd85332459c83c5cb", "versionType": "git"}, {"lessThan": "1a9c180cd8435917b7516edfb1c9148032c28773", "status": "affected", "version": "af2806f8f90a150160be898cd85332459c83c5cb", "versionType": "git"}, {"lessThan": "79dc34beb1fdb3da79753e51e15c68591a2561fe", "status": "affected", "version": "af2806f8f90a150160be898cd85332459c83c5cb", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/skbuff.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.14"}, {"lessThan": "3.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.61", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.15", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker in skb_zerocopy()\n\nskb_zerocopy() moves frag descriptors from @from into @to and takes a\nreference on each frag, but it does not copy skb_shinfo(from)->flags into\nskb_shinfo(to)->flags. A destination skb holding the same page-cache\nbacked frags as the source therefore reports skb_has_shared_frag() as\nfalse.\n\nThat breaks the invariant relied on by later in-place writers. ESP input\nchecks skb_has_shared_frag() before deciding whether an uncloned\nnonlinear skb can skip skb_cow_data(); with the marker lost, an skb that\nskb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is\ndecrypted in place, letting an unprivileged user write into the page\ncache of a root-owned read-only file.\n\nPropagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for\nthe other frag-transfer helpers."}], "id": "CVE-2026-99284", "lastModified": "2026-11-10T19:22:31.810", "metrics": {}, "published": "2026-11-07T21:17:00.603", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1a9c180cd8435917b7516edfb1c9148032c28773"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c623e3cbf43f12dd4a72712079bfa247a9b8ba3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/79dc34beb1fdb3da79753e51e15c68591a2561fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d7d6ff98d5d1b400f02211f962ac32cc0020aeab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fe8477e23dd2ee6bce231d65f2586a333b211dc0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: privilege escalation via missing shared fragment flag in skb_zerocopy", "id": "2568683", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568683"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-281", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: skbuff: propagate shared-frag marker in skb_zerocopy()\nskb_zerocopy() moves frag descriptors from @from into @to and takes a\nreference on each frag, but it does not copy skb_shinfo(from)->flags into\nskb_shinfo(to)->flags. A destination skb holding the same page-cache\nbacked frags as the source therefore reports skb_has_shared_frag() as\nfalse.\nThat breaks the invariant relied on by later in-place writers. ESP input\nchecks skb_has_shared_frag() before deciding whether an uncloned\nnonlinear skb can skip skb_cow_data(); with the marker lost, an skb that\nskb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is\ndecrypted in place, letting an unprivileged user write into the page\ncache of a root-owned read-only file.\nPropagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for\nthe other frag-transfer helpers.", "A flaw was found in the Linux kernel. A local unprivileged user could exploit this flaw to achieve privilege escalation by modifying read-only files cached in memory. The issue occurs because the networking subsystem fails to preserve shared memory indicators when transferring network data buffers. Consequently, subsequent operations such as Encapsulating Security Payload (ESP) decryption modify shared memory pages directly in place rather than creating a safe copy."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-99284", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-07T20:40:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99284\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99284\nhttps://git.kernel.org/stable/c/1a9c180cd8435917b7516edfb1c9148032c28773\nhttps://git.kernel.org/stable/c/1c623e3cbf43f12dd4a72712079bfa247a9b8ba3\nhttps://git.kernel.org/stable/c/79dc34beb1fdb3da79753e51e15c68591a2561fe\nhttps://git.kernel.org/stable/c/d7d6ff98d5d1b400f02211f962ac32cc0020aeab"], "statement": "This vulnerability is classified as having an Important severity because it enables an authenticated local attacker to bypass system file protections and achieve root-level privilege escalation. In standard deployments, the Linux kernel networking subsystem mishandles shared buffer state during packet zero-copy procedures, which allows subsequent cryptographic operations to overwrite memory-cached pages belonging to write-protected system files. While exploiting the condition depends on interactions with packet processing pathways such as netfilter queueing or Open vSwitch, the resulting ability to alter sensitive files presents a severe threat to host integrity.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[af2806f8f90a150160be898cd85332459c83c5cb,1c623e3cbf43f12dd4a72712079bfa247a9b8ba3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[af2806f8f90a150160be898cd85332459c83c5cb,d7d6ff98d5d1b400f02211f962ac32cc0020aeab)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[af2806f8f90a150160be898cd85332459c83c5cb,1a9c180cd8435917b7516edfb1c9148032c28773)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[af2806f8f90a150160be898cd85332459c83c5cb,79dc34beb1fdb3da79753e51e15c68591a2561fe)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.61,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.15,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[af2806f8f90a150160be898cd85332459c83c5cb,1c623e3cbf43f12dd4a72712079bfa247a9b8ba3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[af2806f8f90a150160be898cd85332459c83c5cb,d7d6ff98d5d1b400f02211f962ac32cc0020aeab)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[af2806f8f90a150160be898cd85332459c83c5cb,1a9c180cd8435917b7516edfb1c9148032c28773)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[af2806f8f90a150160be898cd85332459c83c5cb,79dc34beb1fdb3da79753e51e15c68591a2561fe)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.61,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.15,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-07T21:45:16.517290+00:00", "updated": "2026-11-09T01:30:15.686317+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-269", "CWE-281"]}