In the Linux kernel, the following vulnerability has been resolved: tcp: reject net_iov in zerocopy receive mapping hints After copying a readable… (CVE-2026-99055)

The Linux kernel vulnerability CVE-2026-99055 concerns the TCP zerocopy receive path where, after copying a readable prefix, the function receive_fallback_to_copy() queries tcp_zerocopy_set_hint_for_skb() for where page mapping can resume. If the next socket buffer (skb) is unreadable, find_next_mappable_frag() passes a net_iov fragment to can_map_frag(). Since skb_frag_page() returns NULL for net_iov fragments but can_map_frag() dereferences this NULL pointer in PageCompound(), this leads to a kernel panic triggered by a null pointer dereference. The vulnerability was detected by a KASAN run simulating a TCP socket with readable bytes followed by a NET_IOV_DMABUF fragment. The fix involves rejecting all net_iov fragments before skb_frag_page() is called, covering both DMABUF and IOURING net_iov types, thus preventing the fault while leaving page-backed checks unchanged.

The vulnerability causes a kernel panic due to a null pointer dereference in the TCP zerocopy receive path when handling net_iov fragments. This can lead to denial of service by crashing the kernel. There is no indication of code execution or data corruption beyond the panic. The issue was detected under specific test conditions involving KASAN and DMA-buf-bound RX queues.

A fix has been implemented that rejects all net_iov fragments before accessing skb_frag_page(), preventing the null pointer dereference and kernel panic. Users should apply the official Linux kernel update that includes this patch. Since this is a kernel-level vulnerability, upgrading to a patched kernel version is the recommended remediation. No additional mitigations are indicated.