# Linux: local users can modify protected file data through a kernel flaw Canonical: https://www.oktsec.com/radar/linux-kernel-cve-2026-99284 Publisher: Oktsec Language: en Published: 2026-11-13T02:18:43Z Updated: 2026-11-13T02:18:43Z Record reviewed: 2026-11-13T02:18:43Z Latest evidence check: 2026-11-13T02:18:43Z Disclosed: 2026-11-07 The Linux maintainers describe a local flaw that can let an unprivileged user modify cached data for a protected file. Debian lists a correction for trixie, while bookworm remains vulnerable in the reviewed tracker. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: The maintainer confirms a kernel path that can permit local writes to protected file data. Corrections exist for several upstream branches and Debian trixie; Debian bookworm remains unresolved and attacks are not established. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Additional action required - Exposure requirement: Application or configuration dependent - Vendor: Linux - Products: Linux kernel - CVEs: CVE-2026-99284 ## Technical overview The defect is in skb_zerocopy: it copies fragment references without preserving the shared fragment marker. Later ESP processing may then write into shared file data rather than making a private copy. The Linux maintainers describe an unprivileged user modifying page cache contents for a protected file through the nfnetlink_queue or Open vSwitch path. This is a separate vulnerability from CVE-2026-98432, the MPTCP issue already covered by Radar. It requires local access and the affected kernel behavior; the reviewed records do not establish remote exploitation or real attacks. Upstream corrections are available in 6.12.117, 6.18.61, 7.2.15 and 7.3.2. Distribution backports must be assessed separately: Debian identifies trixie as fixed from 6.12.115-1, with 6.12.116-1 in its security repository, while bookworm remains vulnerable. Do not assume that a numerically lower distribution version lacks the fix. Oktsec recommends installing the appropriate vendor package, rebooting and confirming the running kernel. Hosts without a verified correction remain pending even when another branch has a patch. ## Recommended response Install the correction supplied for the distribution and kernel branch, reboot and verify the running kernel. Debian trixie is fixed from package 6.12.115-1; bookworm has no fixed package listed in the reviewed tracker. Relevant to: Linux operators whose kernels include the affected skb_zerocopy path, particularly hosts permitting untrusted local execution. ## CVE attribution - CVE-2026-99284: Linux — Linux kernel. [Source](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/99xxx/CVE-2026-99284.json) ## Affected systems and fixes ### Upstream Linux 6.12 Affected: Affected 6.12 kernels before 6.12.117; distribution backports must be checked separately Fixed release / action: 6.12.117 or later in this branch ### Upstream Linux 6.18 Affected: Affected 6.18 kernels before 6.18.61; distribution backports must be checked separately Fixed release / action: 6.18.61 or later in this branch ### Upstream Linux 7.2 Affected: Affected 7.2 kernels before 7.2.15; distribution backports must be checked separately Fixed release / action: 7.2.15 or later in this branch ### Upstream Linux 7.3 Affected: Affected 7.3 kernels before 7.3.2; distribution backports must be checked separately Fixed release / action: 7.3.2 or later in this branch ### Debian trixie linux source package Affected: Earlier packages without the distribution correction Fixed release / action: 6.12.115-1; current security package 6.12.116-1 is listed fixed ### Debian bookworm linux source package Affected: 6.1.176-1 and security package 6.1.190-1 are listed vulnerable Fixed release / action: No fixed bookworm package listed in the reviewed Debian tracker Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-13T02:21:36.147Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-13T02:21:36.567Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-99284](https://api.first.org/data/v1/epss?cve=CVE-2026-99284): 0.21% probability of observed exploitation in the next 30 days; percentile 11.19%; score date 2026-11-12. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-13T02:21:36.567Z. ## Response checklist 1. **Check the kernel and distribution package** — Identify the running kernel and the distribution’s CVE status. The documented path involves skb_zerocopy, nfnetlink_queue or an Open vSwitch upcall, and subsequent ESP processing; it is not a generic remote login bypass. 2. **Install the vendor correction and reboot** — Use the distribution’s corrected package or the appropriate corrected upstream branch. Debian trixie has a backport from 6.12.115-1, which need not match the upstream version number. Reboot and verify the active kernel. 3. **Track bookworm separately** — The reviewed Debian tracker still labels bookworm and bookworm security packages vulnerable. Oktsec recommends reducing untrusted local execution while following the distribution’s correction; this precaution is not evidence that the flaw is fully mitigated. 4. **Investigate suspicious changes if evidence warrants it** — Oktsec recommends preserving evidence and examining unexplained changes to protected files if local abuse is suspected. The reviewed maintainer and Debian records do not establish exploitation in real attacks. ## Relevance to AI environments Oktsec recommends including this component in infrastructure inventories used by security automation; this vulnerability is not specific to AI. ## Sources - [Linux CNA record: shared fragment marker and upstream corrections](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/99xxx/CVE-2026-99284.json) — Linux maintainers (CNA record); Vendor notice; checked 2026-11-13T02:13:42Z - [Debian package status for CVE-2026-99284](https://security-tracker.debian.org/tracker/CVE-2026-99284) — Debian; Vendor notice; checked 2026-11-13T02:13:52Z ## Editorial record - 2026-11-13T02:18:43Z: Added verified affected versions, branch corrections and the conditions described by the publisher. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/linux-kernel-cve-2026-99284) · [Build a response plan](https://www.oktsec.com/radar/linux-kernel-cve-2026-99284#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=linux-kernel-cve-2026-99284&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=linux-kernel-cve-2026-99284&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.