{ "cveId": "CVE-2026-99055", "url": "https://patchblox.com/security/cve/CVE-2026-99055", "summary": "CVE-2026-99055 is fixed in 19 products on 1 platform, first by DEBIAN-CVE-2026-99055, released October 24, 2026. It is not reported as exploited. Patch Radar priority: High.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: tcp: reject net_iov in zerocopy receive mapping...", "description": "In the Linux kernel, the following vulnerability has been resolved: tcp: reject net_iov in zerocopy receive mapping hints After copying a readable prefix, receive_fallback_to_copy() asks tcp_zerocopy_set_hint_for_skb() where page mapping can resume. If the next skb is unreadable, find_next_mappable_frag() passes its net_iov fragment to can_map_frag(). skb_frag_page() returns NULL for a net_iov, but can_map_frag() dereferences it in PageCompound(). A v7.2 KASAN run on a connected TCP socket with 64 readable bytes followed by a 4096-byte NET_IOV_DMABUF fragment reported: BUG: KASAN: null-ptr-deref in can_map_frag tcp_zerocopy_receive -\u003E can_map_frag Kernel panic - not syncing: KASAN: panic_on_warn set The diagnostic inserted the net_iov directly because the test host has no devmem-capable NIC. Hardware end-to-end reachability remains untested and requires CONFIG_NET_DEVMEM plus a supported DMA-buf-bound RX queue. Reject all net_iov fragments before skb_frag_page(). This covers both DMABUF and IOURING net_iov types while leaving page-backed checks unchanged. With the guard, the same queue copied the readable prefix, returned a 4096-byte skip hint, and completed without a fault.", "published": "2026-10-23T13:17:29Z", "severity": "important", "epss": 0.00168, "epssPercentile": 0.06183, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool6.12", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "bpftool6.12-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel-livepatch-6.12.113-138.209", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.12", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.12-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.12-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.12-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.12-devel", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.12-headers", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.12-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.12-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.12-tools", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.12-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "kernel6.12-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.12.113-1", "fix": "DEBIAN-CVE-2026-99055", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99055", "released": "2026-10-24T13:25:57Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.2.11-1", "fix": "DEBIAN-CVE-2026-99055", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99055", "released": "2026-10-24T13:25:57Z" }, { "platform": "linux", "product": "perf6.12", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "perf6.12-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "python3-perf6.12", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" }, { "platform": "linux", "product": "python3-perf6.12-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.12.113-138.209.amzn2023", "fix": "ALAS2023-2026-3335", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-3335", "released": "2026-11-07T01:06:52Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T13:06:02Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }