PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-99055 Linux CVE debrief

A vulnerability in the Linux kernel's TCP zerocopy receive functionality has been addressed. The issue arises when receive_fallback_to_copy() requests tcp_zerocopy_set_hint_for_skb() to locate the next mappable fragment. If the subsequent skb is unreadable, find_next_mappable_frag() passes its net_iov fragment to can_map_frag(), leading to a null pointer dereference in PageCompound().

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-23
Advisory published
2026-10-23
Advisory updated
2026-10-23

Who should care

Linux kernel developers, maintainers, and users who rely on TCP zerocopy receive functionality should assess exposure and apply patches to prevent potential null pointer dereferences. Operators managing Linux kernel-based systems, platform administrators, vulnerability management teams, and security teams should review the vulnerability and take necessary actions to secure their environments.

Why it matters

A vulnerability in the Linux kernel's TCP zerocopy receive functionality can lead to a null pointer dereference. Linux kernel developers, maintainers, and users should assess exposure and apply patches.

  • Verify Linux kernel versions to determine potential exposure.
  • Assess configurations for used versions and potential impact.
  • Apply patches from Linux kernel maintainers to prevent null pointer dereferences.
  • Monitor for potential issues related to TCP zerocopy receive functionality.

Technical summary

The Linux kernel's TCP zerocopy receive functionality did not properly handle net_iov fragments, leading to a null pointer dereference. A fix has been applied to reject all net_iov fragments before skb_frag_page(). This change ensures that the kernel can safely handle TCP zerocopy receive functionality without encountering null pointer dereferences. Linux kernel developers, maintainers, and users should assess exposure and apply patches to prevent potential issues. The vulnerability was reported through a KASAN run on a connected TCP socket with specific readable and NET_IOV_DMABUF fragment configurations.

Defensive priority

Verify Linux kernel versions and assess exposure based on used versions and configurations.

Recommended defensive actions

  • Verify Linux kernel versions and assess exposure based on used versions and configurations.
  • Review and apply patches from Linux kernel maintainers.
  • Monitor for potential null pointer dereferences in PageCompound().
  • Update to a fixed Linux kernel version.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was reported through a KASAN run on a connected TCP socket with specific readable and NET_IOV_DMABUF fragment configurations. The diagnostic directly inserted the net_iov due to the test host lacking a devmem-capable NIC.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-99055 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-99055

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-99055 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-99055

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • tcp: reject net_iov in zerocopy receive mapping hints

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/99xxx/CVE-2026-99055.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/563d3564513496b9ce3b3ba7a5154427554d0f06

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1c7463ac0e99cc91c4eecc1b69a740ef1a619932

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3aa6f536a95eb0617c313ae2eb76fdfa85331f85

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8b1f0af1fd5fd113432233ed8a3862ee7c30a84f

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.