CVE-2026-99284

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: propagate shared-frag marker in skb_zerocopy()

skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)->flags into skb_shinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skb_has_shared_frag() as false.

That breaks the invariant relied on by later in-place writers. ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file.

Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for the other frag-transfer helpers.

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: propagate shared-frag marker in skb_zerocopy()

skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)->flags into skb_shinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skb_has_shared_frag() as false.

That breaks the invariant relied on by later in-place writers. ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file.

Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for the other frag-transfer helpers.

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: propagate shared-frag marker in skb_zerocopy()

skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)->flags into skb_shinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skb_has_shared_frag() as false.

That breaks the invariant relied on by later in-place writers. ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file.

Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for the other frag-transfer helpers.

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: propagate shared-frag marker in skb_zerocopy()

skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)->flags into skb_shinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skb_has_shared_frag() as false.

That breaks the invariant relied on by later in-place writers. ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file.

Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for the other frag-transfer helpers.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)
• kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
• kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303)
• kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
• kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083)
• kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)
• kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510)
• kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
• kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
• kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
• kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
• kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)
• kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)
• kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)
• kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
• kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)
• kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)
• kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege Escalation Vulnerability ()

Bug Fix(es) and Enhancement(s):

• kernel panic in percpu_counter_add_batch() via submit_bio_noacct() due to NULL pointer (JIRA:RHEL-250378)
• ipv4: ip_gre: make ipgre_header() robust (rhel-9.8.z) (JIRA:RHEL-271127)
• ip6_gre: make ip6gre_header() robust (rhel-9.8.z) (JIRA:RHEL-271130)
• Backport "sched: The newidle balance regression" series to rhel 9.8 [rhel-9.8.z] (JIRA:RHEL-288067)
• AlmaLinux is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z] (JIRA:RHEL-291352)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Kernel: Denial of Service in network socket error handling (CVE-2026-22977)
• kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174)
• kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
• kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398)
• kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169)
• kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283)
• kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586)
• kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
• kernel: KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932)
• kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
• kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827)
• kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)
• kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)
• kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)
• kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
• kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)

Bug Fix(es) and Enhancement(s):

• ipv4: ip_gre: make ipgre_header() robust (rhel-10.2.z) (JIRA:RHEL-270702)
• ip6_gre: make ip6gre_header() robust (rhel-10.2.z) (JIRA:RHEL-270721)
• AlmaLinux is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.2.z] (JIRA:RHEL-291348)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.