Junglewise Threat Intelligence

CVE-2026-74627: Linux kernel net-iov / page fragment mixing vulnerability

CVE-2026-74627 · Severity: high · CVSS 7.8 · Published 2026-08-22

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's network device memory handling allows mixing of incompatible buffer types (net_iov and page-backed fragments) in a single socket buffer, causing system crashes or kernel panics. This affects systems using zero-copy network transmission features, potentially disrupting network services and causing denial of service.

Technical details

The vulnerability exists in the zerocopy_fill_skb_from_devmem() function in net/core/datagram.c, where insufficient validation allows both net_iov and page-backed fragments to coexist in a single socket buffer (skb). This mixing causes undefined behavior and crashes downstream in the network stack. The fix adds a simple check (if (i && skb_frags_readable(skb)) return -EFAULT;) to prevent this mixing by rejecting operations that would combine incompatible fragment types. No authentication or special privileges are required; the vulnerability can be triggered through normal zero-copy network transmission paths. A patch was committed on 2026-07-27 and merged by 2026-07-30.

Affected products

  • Linux Linux kernel versions with net-iov support (approximately 5.20 and later)

Timeline

  • 2026-08-22: disclosed: Published in NVD
  • 2026-07-27: patched: Fix committed upstream
  • 2026-07-30: patched: Fix merged by Jakub Kicinski

References

Related threats