SB20261023100 - NULL pointer dereference in Linux kernel ipv4

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-99055)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to a null pointer dereference in can_map_frag() in the Linux kernel TCP implementation when determining page mapping hints for zerocopy receives. A local user can trigger processing of a readable prefix followed by an unreadable net_iov fragment to cause a kernel crash when skb_frag_page() returns NULL and PageCompound() dereferences it.

Hardware end-to-end reachability remains untested and requires CONFIG_NET_DEVMEM and a supported DMA-buf-bound RX queue; the diagnostic directly inserted the net_iov fragment.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1c7463ac0e99cc91c4eecc1b69a740ef1a619932
• https://git.kernel.org/stable/c/3aa6f536a95eb0617c313ae2eb76fdfa85331f85
• https://git.kernel.org/stable/c/563d3564513496b9ce3b3ba7a5154427554d0f06
• https://git.kernel.org/stable/c/8b1f0af1fd5fd113432233ed8a3862ee7c30a84f