CVE-2026-99284 linux linux

no score yetEPSS 0.2%Fix available

linux linux: no CVSS score yet. EPSS 0.2% estimated probability of exploitation activity in the next 30 days.

On this page

Ask an AI about this CVE
Affected
Versions
Fix and patched versions
Linux distributions
Red Hat
References
Your exposure

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)->flags into skb_shinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skb_has_shared_frag() as false. That breaks the invariant relied on by later in-place writers. ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file. Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for the other frag-transfer helpers.

EPSS: 0.2% estimated probability of exploitation activity in the next 30 days; 11th percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
Published: 2026-11-07 21:17 UTC
Modified: 2026-11-10 19:22 UTC
Assigned by: Linux (CNA)
NVD analysis: Awaiting analysis
Record from: the NVD, synced 2026-11-10 19:47 UTC

Ask an AI about this CVE

ChatGPT Claude Google AI Mode

Show the prompt

Explain CVE-2026-99284 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-99284?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-99284?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-99284 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Badge for a README or a site

An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:

[![CVE-2026-99284](https://cve.bz/cve/badge/CVE-2026-99284.svg)](https://cve.bz/cve/CVE-2026-99284)

HTML:

<a href="https://cve.bz/cve/CVE-2026-99284"><img src="https://cve.bz/cve/badge/CVE-2026-99284.svg" alt="CVE-2026-99284"></a>

Affected

linux:linux

Versions

From the CNA's record in the CVE List.

Product	Affected
Linux	3.14 and later

Fixed in

Product	Release line	Fixed in
Linux	6.12	6.12.117
Linux	6.18	6.18.61
Linux	7.2	7.2.15
Linux	7.3	7.3.2
Linux	later releases	7.4-rc1

Fix and patched versions

Linux Linux: fixed in 6.12.117
Linux Linux: fixed in 6.18.61
Linux Linux: fixed in 7.2.15
Linux Linux: fixed in 7.3.2
Linux Linux: fixed in 7.4-rc1
Debian, Red Hat, AlmaLinux, Alpaquita: fixed package versions per release

Linux distributions

Distribution	Release	Package	Fixed in	Advisory
Debian	12	linux	no fix listed	DEBIAN-CVE-2026-99284
Debian	12	linux-6.12	6.12.115-2~deb12u1	DEBIAN-CVE-2026-99284
Debian	13	linux	6.12.115-1	DEBIAN-CVE-2026-99284
Debian	14	linux	7.2.14-1	DEBIAN-CVE-2026-99284
Ubuntu	16.04:LTS	linux-hwe-edge	no fix listed	UBUNTU-CVE-2026-99284
Ubuntu	18.04:LTS	linux-gcp, linux-hwe, linux-oem and 12 more	no fix listed	UBUNTU-CVE-2026-99284
Ubuntu	20.04:LTS	linux-gke, linux-gkeop, linux-riscv and 26 more	no fix listed	UBUNTU-CVE-2026-99284
Ubuntu	22.04:LTS	linux, linux-aws, linux-gcp and 57 more	no fix listed	UBUNTU-CVE-2026-99284
Ubuntu	24.04:LTS	linux, linux-aws, linux-gcp and 50 more	no fix listed	UBUNTU-CVE-2026-99284
Ubuntu	26.04:LTS	linux, linux-aws, linux-gcp and 12 more	no fix listed	UBUNTU-CVE-2026-99284
Ubuntu	26.10	linux, linux-aws, linux-gcp and 6 more	no fix listed	UBUNTU-CVE-2026-99284
Ubuntu	Nvidia-BlueField:22.04:LTS, Nvidia-BlueField:24.04:LTS	linux-bluefield	no fix listed	UBUNTU-CVE-2026-99284
Ubuntu	Pro:14.04:LTS	linux, linux-aws, linux-azure and 1 more	no fix listed	UBUNTU-CVE-2026-99284
Ubuntu	Pro:16.04:LTS	linux, linux-aws, linux-gcp and 5 more	no fix listed	UBUNTU-CVE-2026-99284
Ubuntu	Pro:18.04:LTS	linux, linux-aws, linux-kvm and 10 more	no fix listed	UBUNTU-CVE-2026-99284
Ubuntu	Pro:20.04:LTS	linux, linux-aws, linux-gcp and 19 more	no fix listed	UBUNTU-CVE-2026-99284
4 more for Ubuntu in the JSON and on Ubuntu's page.
Red Hat	enterprise_linux:8::baseos	perf, kernel, bpftool and 30 more	0:4.18.0-553.181.1.el8_10	RHSA-2026:93436
Red Hat	enterprise_linux:8::crb	perf-debuginfo, kernel-debuginfo, bpftool-debuginfo and 7 more	0:4.18.0-553.181.1.el8_10	RHSA-2026:93436
Red Hat	enterprise_linux:8::nfv	kernel-rt, kernel-rt-kvm, kernel-rt-core and 12 more	0:4.18.0-553.181.1.rt7.522.el8_10	RHSA-2026:93437
Red Hat	enterprise_linux:8::realtime	kernel-rt, kernel-rt-core, kernel-rt-debug and 10 more	0:4.18.0-553.181.1.rt7.522.el8_10	RHSA-2026:93437
Red Hat	enterprise_linux:9::appstream	rv, perf, rtla and 29 more	0:5.14.0-687.64.1.el9_8	RHSA-2026:93412
Red Hat	enterprise_linux:9::baseos	kernel, kernel-64k, kernel-core and 45 more	0:5.14.0-687.64.1.el9_8	RHSA-2026:93412
Red Hat	enterprise_linux:9::crb	libperf, perf-debuginfo, kernel-debuginfo and 16 more	0:5.14.0-687.64.1.el9_8	RHSA-2026:93412
Red Hat	enterprise_linux:9::nfv	kernel-rt, kernel-rt-core, perf-debuginfo and 18 more	0:5.14.0-687.64.1.el9_8	RHSA-2026:93412
Red Hat	enterprise_linux:9::realtime	kernel-rt, kernel-rt-64k, kernel-rt-core and 35 more	0:5.14.0-687.64.1.el9_8	RHSA-2026:93412
Red Hat	enterprise_linux:10.2	rv, perf, rtla and 88 more	0:6.12.0-211.72.1.el10_2	RHSA-2026:93413
Red Hat	enterprise_linux_eus:10.0	rv, perf, rtla and 88 more	0:6.12.0-55.117.1.el10_0	RHSA-2026:94508
Red Hat	rhel_aus:8.4::baseos, rhel_eus_long_life:8.4::baseos	perf, kernel, bpftool and 21 more	0:4.18.0-305.217.1.el8_4	RHSA-2026:94596
23 more for Red Hat in the JSON and on Red Hat's page.
AlmaLinux	8	kernel-rt, kernel-rt-core, kernel-rt-debug and 7 more	4.18.0-553.181.1.rt7.522.el8_10	ALSA-2026:93437
AlmaLinux	8	perf, kernel, bpftool and 22 more	4.18.0-553.181.1.el8_10	ALSA-2026:93436
AlmaLinux	9	rv, perf, rtla and 71 more	5.14.0-687.64.1.el9_8	ALSA-2026:93412
AlmaLinux	10	rv, perf, rtla and 72 more	6.12.0-211.72.1.el10_2	ALSA-2026:93413
Azure Linux	3	kernel	no fix listed	AZL-112868
Alpaquita	23, 25	linux-lts	no fix listed	BELL-CVE-2026-99284
Alpaquita	stream	linux-lts	6.18.62-r0	BELL-CVE-2026-99284

From the distributions' data via OSV.dev: the Debian Security Tracker; Ubuntu Security Notices © Canonical Ltd., CC BY-SA 4.0; Red Hat Security Data © Red Hat, Inc., CC BY 4.0; AlmaLinux's OSV database, MIT; Microsoft's Azure Linux vulnerability data, MIT; BellSoft's OSV database, MIT. Modified: reformatted and linked to CVE records. Credits. On the distributions' own pages: Debian · Ubuntu · Red Hat · Alpaquita.

Red Hat

Red Hat rates this Important.

Red Hat's statement

This vulnerability is classified as having an Important severity because it enables an authenticated local attacker to bypass system file protections and achieve root-level privilege escalation. In standard deployments, the Linux kernel networking subsystem mishandles shared buffer state during packet zero-copy procedures, which allows subsequent cryptographic operations to overwrite memory-cached pages belonging to write-protected system files. While exploiting the condition depends on interactions with packet processing pathways such as netfilter queueing or Open vSwitch, the resulting ability to alter sensitive files presents a severe threat to host integrity.

Red Hat's mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Product	Package	State
Red Hat Enterprise Linux 10	kernel	Fix deferred
Red Hat Enterprise Linux 6	kernel	Affected
Red Hat Enterprise Linux 7	kernel	Fix deferred
Red Hat Enterprise Linux 7	kernel-rt	Fix deferred
Red Hat Enterprise Linux 8	kernel	Fix deferred
Red Hat Enterprise Linux 8	kernel-rt	Fix deferred
Red Hat Enterprise Linux 9	kernel	Fix deferred
Red Hat Enterprise Linux 9	kernel-rt	Fix deferred
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-8	Affected
Red Hat OpenShift Container Platform 4	openshift/ose-rhel-coreos-9	Affected
Red Hat OpenShift Container Platform 5	openshift/ose-rhel-coreos-10	Affected
Red Hat OpenShift Container Platform 5	openshift/ose-rhel-coreos-9	Affected

Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-99284.

References

Check your stack JSON