CVE-2026-90051 (GCVE-0-2026-90051)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:05 – Updated: 2026-10-19 08:57
VLAI
Title
tcp: reject non zerocopy devmem tx
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIF_F_SG isn't present. In this case, tcp_sendmsg_locked() will try the copy path and try to copy data from an iovec which consists of offsets into the dma-buf and would normally fail. Moreover, d9c56501c72fd ("net: tcp: block mixing readable and unreadable frags") relies on that and assumes that the devmem binding is present IFF we're using the zero-copy path, which can be used to mix net-iov and pages in a single skb, and break invariants. Let's reject devmem tx without zero-copy. Note, the parameter check the patch is modifying is too loose, we can create an io_uring request with dmabuf_id and all ZC flags, but which won't have the binding. We replace it with stricter validation.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6639 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bd61848900bff597764238f3a8ec67c815cd316e , < 2151b2bcf6fcec52665f606eed20da068447f0b7 (git)
Affected: bd61848900bff597764238f3a8ec67c815cd316e , < b04326c7927af7048fd4e730f5770cca350d0a60 (git)
Affected: bd61848900bff597764238f3a8ec67c815cd316e , < 125755776bc6d4dd53eaf551c87e3d460625d638 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2151b2bcf6fcec52665f606eed20da068447f0b7",
              "status": "affected",
              "version": "bd61848900bff597764238f3a8ec67c815cd316e",
              "versionType": "git"
            },
            {
              "lessThan": "b04326c7927af7048fd4e730f5770cca350d0a60",
              "status": "affected",
              "version": "bd61848900bff597764238f3a8ec67c815cd316e",
              "versionType": "git"
            },
            {
              "lessThan": "125755776bc6d4dd53eaf551c87e3d460625d638",
              "status": "affected",
              "version": "bd61848900bff597764238f3a8ec67c815cd316e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: reject non zerocopy devmem tx\n\nDevmem tcp tx doesn\u0027t work without zero-copy, however it\u0027s not currently\nenforced if NETIF_F_SG isn\u0027t present. In this case, tcp_sendmsg_locked()\nwill try the copy path and try to copy data from an iovec which consists\nof offsets into the dma-buf and would normally fail. Moreover,\nd9c56501c72fd (\"net: tcp: block mixing readable and unreadable frags\")\nrelies on that and assumes that the devmem binding is present IFF we\u0027re\nusing the zero-copy path, which can be used to mix net-iov and pages in\na single skb, and break invariants. Let\u0027s reject devmem tx without\nzero-copy.\n\nNote, the parameter check the patch is modifying is too loose, we can\ncreate an io_uring request with dmabuf_id and all ZC flags, but which\nwon\u0027t have the binding. We replace it with stricter validation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The triggering input is local sendmsg or io_uring IORING_OP_SENDMSG_ZC into tcp_sendmsg_locked(): SO_ZEROCOPY, MSG_ZEROCOPY, and an SCM_DEVMEM_DMABUF cmsg that sets sockc.dmabuf_id. A remote TCP peer never supplies that cmsg or those send flags; it only receives the resulting segments.\nAC:L - The attacker drives both sendmsg calls: a MSG_ZEROCOPY+SCM_DEVMEM_DMABUF send queues net-iov (unreadable) frags, then a later sendmsg with sockc.dmabuf_id while zc==0 (sk_route_caps lacks NETIF_F_SG, so the copy path runs with binding set) appends pages onto that skb. MSG_MORE retains the write-queue tail; no victim race is required.\nPR:L - NETDEV_CMD_BIND_TX has no GENL_ADMIN_PERM, and SO_ZEROCOPY plus __sock_cmsg_send(SCM_DEVMEM_DMABUF) have no capability checks. An unprivileged user can bind a TX dmabuf and reach the zc/binding check in tcp_sendmsg_locked; any extra CAP_NET_ADMIN is only the user-namespace kind.\nUI:N - The attacker enables SO_ZEROCOPY, binds a dmabuf via netdev-genl NETDEV_CMD_BIND_TX, and issues the crafted sendmsg/IORING_OP_SENDMSG_ZC sequence on their own TCP socket; no victim mount, open, or other interactive action is required.\nS:U - Mixing net_iov and page frags corrupts skb/TX processing on the sending host inside tcp_sendmsg_locked and later frag walkers. It does not cross a VM/guest or IOMMU authority; __skb_frag_dma_map still classifies each frag with skb_frag_is_net_iov.\nC:H - A mixed skb keeps skb-\u003eunreadable from skb_add_rx_frag_netmem while the zc==0 path adds page frags via skb_fill_page_desc. Walkers such as tcp_md5_hash_skb_data use skb_frag_foreach_page/skb_frag_page() on net_iovs (NULL) and kmap that pointer, enabling kernel memory disclosure.\nI:H - Appending sk_page_frag pages onto a net-iov skb via the zc==0 copy path in tcp_sendmsg_locked is frag-type confusion: TX, refcount, and skb_fill_page_desc versus skb_add_rx_frag_netmem cannot treat mixed backing consistently, which yields corrupted skb metadata and write or control-flow primitives.\nA:H - Mixed readable/unreadable frags blow up down the stack: skb_copy_bits/skb_checksum hit WARN_ON_ONCE(!skb_frags_readable), splice hits WARN_ON_ONCE(!skb_frag_page), and kmap of a NULL net_iov page oopses or panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:57:09.627Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2151b2bcf6fcec52665f606eed20da068447f0b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b04326c7927af7048fd4e730f5770cca350d0a60"
        },
        {
          "url": "https://git.kernel.org/stable/c/125755776bc6d4dd53eaf551c87e3d460625d638"
        }
      ],
      "title": "tcp: reject non zerocopy devmem tx",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90051",
    "datePublished": "2026-09-17T16:05:37.620Z",
    "dateReserved": "2026-09-11T19:38:34.783Z",
    "dateUpdated": "2026-10-19T08:57:09.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90051",
      "date": "2026-11-09",
      "epss": "0.00162",
      "percentile": "0.05365"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-21T18:33:12.000Z",
      "cve": "CVE-2026-90051",
      "id": "msrc_CVE-2026-90051",
      "initial_release_date": "2026-10-20T22:21:43.000Z",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tcp: reject non zerocopy devmem tx",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90051.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv4/tcp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2151b2bcf6fcec52665f606eed20da068447f0b7",
                    "status": "affected",
                    "version": "bd61848900bff597764238f3a8ec67c815cd316e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b04326c7927af7048fd4e730f5770cca350d0a60",
                    "status": "affected",
                    "version": "bd61848900bff597764238f3a8ec67c815cd316e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "125755776bc6d4dd53eaf551c87e3d460625d638",
                    "status": "affected",
                    "version": "bd61848900bff597764238f3a8ec67c815cd316e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv4/tcp.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: reject non zerocopy devmem tx\n\nDevmem tcp tx doesn\u0027t work without zero-copy, however it\u0027s not currently\nenforced if NETIF_F_SG isn\u0027t present. In this case, tcp_sendmsg_locked()\nwill try the copy path and try to copy data from an iovec which consists\nof offsets into the dma-buf and would normally fail. Moreover,\nd9c56501c72fd (\"net: tcp: block mixing readable and unreadable frags\")\nrelies on that and assumes that the devmem binding is present IFF we\u0027re\nusing the zero-copy path, which can be used to mix net-iov and pages in\na single skb, and break invariants. Let\u0027s reject devmem tx without\nzero-copy.\n\nNote, the parameter check the patch is modifying is too loose, we can\ncreate an io_uring request with dmabuf_id and all ZC flags, but which\nwon\u0027t have the binding. We replace it with stricter validation."
          }
        ],
        "id": "CVE-2026-90051",
        "lastModified": "2026-10-19T09:18:53.417",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:16:53.490",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/125755776bc6d4dd53eaf551c87e3d460625d638"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2151b2bcf6fcec52665f606eed20da068447f0b7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b04326c7927af7048fd4e730f5770cca350d0a60"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-06T01:28:45+00:00",
      "cve": "CVE-2026-90051",
      "id": "CVE-2026-90051",
      "initial_release_date": "2026-09-17T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "189",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tcp: reject non zerocopy devmem tx",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90051.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.