CVE-2026-99284: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-99284 is a Linux kernel vulnerability in the skb_zerocopy() function within the networking subsystem (net/skbuff) that allows an unprivileged local user to write into the page cache of a root-owned read-only file. The flaw was disclosed on November 7, 2026, and affects Linux kernel versions from 3.14 onward, with fixes available in stable releases 6.18.61, 7.2.15, 7.3.2, and 7.4-rc1. The CVSS base score is currently listed as 0.0 (unscored) with a category estimate of Medium, and the EPSS score is 0.0 (GitHub Advisory, ENISA EUVD).

The root cause is a missing propagation of the SKBFL_SHARED_FRAG flag in skb_zerocopy(): when frag descriptors are moved from a source skb (@from) to a destination skb (@to), the function copies the frag references but does not copy skb_shinfo(from)->flags into skb_shinfo(to)->flags. As a result, the destination skb incorrectly reports skb_has_shared_frag() as false, even though it holds references to the same page-cache-backed fragments. The ESP input path relies on this flag to decide whether to call skb_cow_data() before in-place decryption; with the marker absent, skbs constructed by skb_zerocopy() for nfnetlink_queue or OpenVSwitch upcalls are decrypted in place, enabling a write into page-cache pages backing root-owned read-only files. This is classified as an improper state management / missing flag propagation issue (no CWE formally assigned yet) (GitHub Advisory, ENISA EUVD).

Successful exploitation allows an unprivileged local attacker to write arbitrary data into the page cache of root-owned read-only files, which can lead to privilege escalation and potentially arbitrary code execution. The integrity of sensitive system files is directly at risk, and if an attacker can corrupt executable or configuration files cached in memory, they may achieve persistent root-level access. Confidentiality and availability impacts are secondary but possible through subsequent privilege escalation actions (GitHub Advisory, ENISA EUVD).

As of the disclosure date (November 7, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (ENISA EUVD). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access to the target system and the ability to trigger nfnetlink_queue or OpenVSwitch upcall processing paths, which limits the immediate attack surface but does not eliminate risk in multi-tenant or container environments.

Apply the upstream Linux kernel patches that propagate SKBFL_SHARED_FRAG in skb_zerocopy(). Fixed versions are available in stable branches: 6.18.61 (commit 1c623e3cbf43f12dd4a72712079bfa247a9b8ba3), 7.2.15 (commit d7d6ff98d5d1b400f02211f962ac32cc0020aeab), 7.3.2 (commit 1a9c180cd8435917b7516edfb1c9148032c28773), and 7.4-rc1 (commit 79dc34beb1fdb3da79753e51e15c68591a2561fe). Until patching is possible, restricting unprivileged access to nfnetlink_queue and OpenVSwitch interfaces (e.g., via namespace isolation or capability restrictions) can reduce exposure (GitHub Advisory, ENISA EUVD).

The vulnerability was announced via the Linux kernel CVE mailing list and quickly indexed by multiple vulnerability tracking services. Social media activity was limited to automated CVE announcement accounts on Mastodon (infosec.exchange) and Bluesky, with no notable independent researcher commentary or media coverage identified at the time of disclosure (ENISA EUVD).