Improper initialization in Linux kernel - CVE-2026-99284

Vulnerability details

The vulnerability allows a local user to modify the page-cache contents of a root-owned read-only file.

The vulnerability exists due to improper initialization of shared-fragment metadata in the Linux kernel skb_zerocopy() function when copying fragment descriptors into a destination socket buffer. A local user can exploit the missing shared-fragment marker on buffers built for nfnetlink_queue or an openvswitch upcall to cause ESP input processing to skip copy-on-write handling and decrypt shared page-cache fragments in place, modifying the contents of a root-owned read-only file.

Affected software

How to mitigate CVE-2026-99284

External References

• https://git.kernel.org/stable/c/1a9c180cd8435917b7516edfb1c9148032c28773
• https://git.kernel.org/stable/c/1c623e3cbf43f12dd4a72712079bfa247a9b8ba3
• https://git.kernel.org/stable/c/79dc34beb1fdb3da79753e51e15c68591a2561fe
• https://git.kernel.org/stable/c/d7d6ff98d5d1b400f02211f962ac32cc0020aeab

Related Security Bulletins

• Improper initialization in Linux kernel core