Reliance on Data/Memory Layout in Linux kernel - CVE-2026-99127

Vulnerability details

The vulnerability allows a local privileged user to cause a denial of service through a kernel panic.

The vulnerability exists due to insufficient fragment alignment in page_pool_alloc_frag_netmem() when processing odd-sized allocation requests on architectures where DMA cache alignment does not ensure socket buffer alignment. A local privileged user can trigger odd-sized packet fragment allocations through generic XDP processing to leave subsequent allocations from the shared page pool misaligned, causing atomic operations during socket buffer cloning to cross cache-line boundaries and panic the kernel on x86 systems with fatal split-lock detection enabled.

Affected software

How to mitigate CVE-2026-99127

External References

• https://git.kernel.org/stable/c/813a72beaa5d3f4bb135e0def9b3f07a3511ca0e
• https://git.kernel.org/stable/c/dc0df5a0c62ccea1d0e08d39a4dc9064de81d411
• https://git.kernel.org/stable/c/dca1b51693c81eaf77e50980be373e01ae857394

Related Security Bulletins

• Reliance on Data/Memory Layout in Linux kernel core
• Debian update for linux