Executive brief
The Linux kernel's TCP networking stack failed to properly validate device memory (devmem) transmit requests, allowing operations that should require zero-copy acceleration to proceed without the necessary hardware support. This could cause data corruption or kernel memory access violations when applications attempt to send data over the network using special DMA buffers on systems without proper hardware acceleration enabled.
Technical details
A validation flaw in tcp_sendmsg_locked() (net/ipv4/tcp.c) allowed device memory transmit operations to bypass zero-copy enforcement checks. The vulnerability exists when NETIF_F_SG (scatter-gather support) is not present; the kernel would attempt a copy path on DMA-buf iovecs, leading to failed invariant checks. An attacker or misconfigured application could exploit loose parameter validation by creating io_uring requests with dmabuf_id and zero-copy flags without an actual devmem binding, mixing incompatible buffer types in a single skb and violating kernel networking invariants. The fix tightens validation to enforce stricter checks: `(zc != MSG_ZEROCOPY || !binding)` replaces the looser original condition, rejecting devmem TX without proper zero-copy setup. The patch was committed by Pavel Begunkov and merged into stable kernels on 2026-09-10.
Affected products
- Linux Linux kernel 5.0 through 6.x (and potentially earlier stable branches)
Timeline
- 2026-09-17: disclosed: CVE-2026-90051 published
- 2026-09-10: patched: Fix committed to stable kernel by Paolo Abeni
- 2026-09-04: other: Patch authored by Pavel Begunkov