Executive brief
A vulnerability in the Linux kernel's network device memory handling allows mixing of incompatible buffer types (net_iov and page-backed fragments) in a single socket buffer, causing system crashes or kernel panics. This affects systems using zero-copy network transmission features, potentially disrupting network services and causing denial of service.
Technical details
The vulnerability exists in the zerocopy_fill_skb_from_devmem() function in net/core/datagram.c, where insufficient validation allows both net_iov and page-backed fragments to coexist in a single socket buffer (skb). This mixing causes undefined behavior and crashes downstream in the network stack. The fix adds a simple check (if (i && skb_frags_readable(skb)) return -EFAULT;) to prevent this mixing by rejecting operations that would combine incompatible fragment types. No authentication or special privileges are required; the vulnerability can be triggered through normal zero-copy network transmission paths. A patch was committed on 2026-07-27 and merged by 2026-07-30.
Affected products
- Linux Linux kernel versions with net-iov support (approximately 5.20 and later)
Timeline
- 2026-08-22: disclosed: Published in NVD
- 2026-07-27: patched: Fix committed upstream
- 2026-07-30: patched: Fix merged by Jakub Kicinski