CVE-2026-99284

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description An issue exists in the skb zerocopy() function where it fails to copy skb shinfo(from)->flags into skb shinfo(to)->flags when moving frag descriptors. This causes the destination skb to incorrectly report skb has shared frag() as false, breaking invariants used by in-place writers. Consequently, an unprivileged user could potentially write into the page cache of a root-owned read-only file when an skb built for nfnetlink queue or an openvswitch upcall is decrypted in place, as the system may skip the skb cow data() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.