Vulnerability-Lookup

FKIE_CVE-2026-90051

Vulnerability from fkie_nvd - Published: 2026-09-17 17:16 - Updated: 2026-10-19 09:18

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIF_F_SG isn't present. In this case, tcp_sendmsg_locked() will try the copy path and try to copy data from an iovec which consists of offsets into the dma-buf and would normally fail. Moreover, d9c56501c72fd ("net: tcp: block mixing readable and unreadable frags") relies on that and assumes that the devmem binding is present IFF we're using the zero-copy path, which can be used to mix net-iov and pages in a single skb, and break invariants. Let's reject devmem tx without zero-copy. Note, the parameter check the patch is modifying is too loose, we can create an io_uring request with dmabuf_id and all ZC flags, but which won't have the binding. We replace it with stricter validation.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/125755776bc6d4dd53eaf551c87e3d460625d638
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2151b2bcf6fcec52665f606eed20da068447f0b7
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b04326c7927af7048fd4e730f5770cca350d0a60

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2151b2bcf6fcec52665f606eed20da068447f0b7",
              "status": "affected",
              "version": "bd61848900bff597764238f3a8ec67c815cd316e",
              "versionType": "git"
            },
            {
              "lessThan": "b04326c7927af7048fd4e730f5770cca350d0a60",
              "status": "affected",
              "version": "bd61848900bff597764238f3a8ec67c815cd316e",
              "versionType": "git"
            },
            {
              "lessThan": "125755776bc6d4dd53eaf551c87e3d460625d638",
              "status": "affected",
              "version": "bd61848900bff597764238f3a8ec67c815cd316e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: reject non zerocopy devmem tx\n\nDevmem tcp tx doesn\u0027t work without zero-copy, however it\u0027s not currently\nenforced if NETIF_F_SG isn\u0027t present. In this case, tcp_sendmsg_locked()\nwill try the copy path and try to copy data from an iovec which consists\nof offsets into the dma-buf and would normally fail. Moreover,\nd9c56501c72fd (\"net: tcp: block mixing readable and unreadable frags\")\nrelies on that and assumes that the devmem binding is present IFF we\u0027re\nusing the zero-copy path, which can be used to mix net-iov and pages in\na single skb, and break invariants. Let\u0027s reject devmem tx without\nzero-copy.\n\nNote, the parameter check the patch is modifying is too loose, we can\ncreate an io_uring request with dmabuf_id and all ZC flags, but which\nwon\u0027t have the binding. We replace it with stricter validation."
    }
  ],
  "id": "CVE-2026-90051",
  "lastModified": "2026-10-19T09:18:53.417",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-17T17:16:53.490",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/125755776bc6d4dd53eaf551c87e3d460625d638"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2151b2bcf6fcec52665f606eed20da068447f0b7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b04326c7927af7048fd4e730f5770cca350d0a60"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-90051 (GCVE-0-2026-90051)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:05 – Updated: 2026-10-19 08:57

Title

tcp: reject non zerocopy devmem tx

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/2151b2bcf6fcec526…
https://git.kernel.org/stable/c/b04326c7927af7048…
https://git.kernel.org/stable/c/125755776bc6d4dd5…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: bd61848900bff597764238f3a8ec67c815cd316e , < 2151b2bcf6fcec52665f606eed20da068447f0b7 (git) Affected: bd61848900bff597764238f3a8ec67c815cd316e , < b04326c7927af7048fd4e730f5770cca350d0a60 (git) Affected: bd61848900bff597764238f3a8ec67c815cd316e , < 125755776bc6d4dd53eaf551c87e3d460625d638 (git)
Linux	Linux	Affected: 6.16 Unaffected: 0 , < 6.16 (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2151b2bcf6fcec52665f606eed20da068447f0b7",
              "status": "affected",
              "version": "bd61848900bff597764238f3a8ec67c815cd316e",
              "versionType": "git"
            },
            {
              "lessThan": "b04326c7927af7048fd4e730f5770cca350d0a60",
              "status": "affected",
              "version": "bd61848900bff597764238f3a8ec67c815cd316e",
              "versionType": "git"
            },
            {
              "lessThan": "125755776bc6d4dd53eaf551c87e3d460625d638",
              "status": "affected",
              "version": "bd61848900bff597764238f3a8ec67c815cd316e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: reject non zerocopy devmem tx\n\nDevmem tcp tx doesn\u0027t work without zero-copy, however it\u0027s not currently\nenforced if NETIF_F_SG isn\u0027t present. In this case, tcp_sendmsg_locked()\nwill try the copy path and try to copy data from an iovec which consists\nof offsets into the dma-buf and would normally fail. Moreover,\nd9c56501c72fd (\"net: tcp: block mixing readable and unreadable frags\")\nrelies on that and assumes that the devmem binding is present IFF we\u0027re\nusing the zero-copy path, which can be used to mix net-iov and pages in\na single skb, and break invariants. Let\u0027s reject devmem tx without\nzero-copy.\n\nNote, the parameter check the patch is modifying is too loose, we can\ncreate an io_uring request with dmabuf_id and all ZC flags, but which\nwon\u0027t have the binding. We replace it with stricter validation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The triggering input is local sendmsg or io_uring IORING_OP_SENDMSG_ZC into tcp_sendmsg_locked(): SO_ZEROCOPY, MSG_ZEROCOPY, and an SCM_DEVMEM_DMABUF cmsg that sets sockc.dmabuf_id. A remote TCP peer never supplies that cmsg or those send flags; it only receives the resulting segments.\nAC:L - The attacker drives both sendmsg calls: a MSG_ZEROCOPY+SCM_DEVMEM_DMABUF send queues net-iov (unreadable) frags, then a later sendmsg with sockc.dmabuf_id while zc==0 (sk_route_caps lacks NETIF_F_SG, so the copy path runs with binding set) appends pages onto that skb. MSG_MORE retains the write-queue tail; no victim race is required.\nPR:L - NETDEV_CMD_BIND_TX has no GENL_ADMIN_PERM, and SO_ZEROCOPY plus __sock_cmsg_send(SCM_DEVMEM_DMABUF) have no capability checks. An unprivileged user can bind a TX dmabuf and reach the zc/binding check in tcp_sendmsg_locked; any extra CAP_NET_ADMIN is only the user-namespace kind.\nUI:N - The attacker enables SO_ZEROCOPY, binds a dmabuf via netdev-genl NETDEV_CMD_BIND_TX, and issues the crafted sendmsg/IORING_OP_SENDMSG_ZC sequence on their own TCP socket; no victim mount, open, or other interactive action is required.\nS:U - Mixing net_iov and page frags corrupts skb/TX processing on the sending host inside tcp_sendmsg_locked and later frag walkers. It does not cross a VM/guest or IOMMU authority; __skb_frag_dma_map still classifies each frag with skb_frag_is_net_iov.\nC:H - A mixed skb keeps skb-\u003eunreadable from skb_add_rx_frag_netmem while the zc==0 path adds page frags via skb_fill_page_desc. Walkers such as tcp_md5_hash_skb_data use skb_frag_foreach_page/skb_frag_page() on net_iovs (NULL) and kmap that pointer, enabling kernel memory disclosure.\nI:H - Appending sk_page_frag pages onto a net-iov skb via the zc==0 copy path in tcp_sendmsg_locked is frag-type confusion: TX, refcount, and skb_fill_page_desc versus skb_add_rx_frag_netmem cannot treat mixed backing consistently, which yields corrupted skb metadata and write or control-flow primitives.\nA:H - Mixed readable/unreadable frags blow up down the stack: skb_copy_bits/skb_checksum hit WARN_ON_ONCE(!skb_frags_readable), splice hits WARN_ON_ONCE(!skb_frag_page), and kmap of a NULL net_iov page oopses or panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:57:09.627Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2151b2bcf6fcec52665f606eed20da068447f0b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b04326c7927af7048fd4e730f5770cca350d0a60"
        },
        {
          "url": "https://git.kernel.org/stable/c/125755776bc6d4dd53eaf551c87e3d460625d638"
        }
      ],
      "title": "tcp: reject non zerocopy devmem tx",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90051",
    "datePublished": "2026-09-17T16:05:37.620Z",
    "dateReserved": "2026-09-11T19:38:34.783Z",
    "dateUpdated": "2026-10-19T08:57:09.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted