CVE-2026-99055

In the Linux kernel, the following vulnerability has been resolved:

tcp: reject net iov in zerocopy receive mapping hints

After copying a readable prefix, receive fallback to copy() asks tcp zerocopy set hint for skb() where page mapping can resume. If the next skb is unreadable, find next mappable frag() passes its net iov fragment to can map frag().

skb frag page() returns NULL for a net iov, but can map frag() dereferences it in PageCompound(). A v7.2 KASAN run on a connected TCP socket with 64 readable bytes followed by a 4096-byte NET IOV DMABUF fragment reported:

BUG: KASAN: null-ptr-deref in can map frag tcp zerocopy receive -> can map frag Kernel panic - not syncing: KASAN: panic on warn set

The diagnostic inserted the net iov directly because the test host has no devmem-capable NIC. Hardware end-to-end reachability remains untested and requires CONFIG NET DEVMEM plus a supported DMA-buf-bound RX queue.

Reject all net iov fragments before skb frag page(). This covers both DMABUF and IOURING net iov types while leaving page-backed checks unchanged. With the guard, the same queue copied the readable prefix, returned a 4096-byte skip hint, and completed without a fault.