SB2026110839 - Improper initialization in Linux kernel core

Description

This security bulletin contains information about 1 vulnerability.

1) Improper initialization (CVE-ID: CVE-2026-99284)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify the page-cache contents of a root-owned read-only file.

The vulnerability exists due to improper initialization of shared-fragment metadata in the Linux kernel skb_zerocopy() function when copying fragment descriptors into a destination socket buffer. A local user can exploit the missing shared-fragment marker on buffers built for nfnetlink_queue or an openvswitch upcall to cause ESP input processing to skip copy-on-write handling and decrypt shared page-cache fragments in place, modifying the contents of a root-owned read-only file.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1a9c180cd8435917b7516edfb1c9148032c28773
• https://git.kernel.org/stable/c/1c623e3cbf43f12dd4a72712079bfa247a9b8ba3
• https://git.kernel.org/stable/c/79dc34beb1fdb3da79753e51e15c68591a2561fe
• https://git.kernel.org/stable/c/d7d6ff98d5d1b400f02211f962ac32cc0020aeab