CVE-2026-90051 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
tcp: reject non zerocopy devmem tx
Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIF_F_SG isn't present. In this case, tcp_sendmsg_locked() will try the copy path and try to copy data from an iovec which consists of offsets into the dma-buf and would normally fail. Moreover, d9c56501c72fd ("net: tcp: block mixing readable and unreadable frags") relies on that and assumes that the devmem binding is present IFF we're using the zero-copy path, which can be used to mix net-iov and pages in a single skb, and break invariants. Let's reject devmem tx without zero-copy.
Note, the parameter check the patch is modifying is too loose, we can create an io_uring request with dmabuf_id and all ZC flags, but which won't have the binding. We replace it with stricter validation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel contains a vulnerability in its Transmission Control Protocol implementation related to the handling of device memory zero-copy transmission paths. Specifically, the tcp_sendmsg_locked function fails to adequately validate whether the necessary conditions for devmem TCP transmit operations are met before attempting data transfer. The core issue arises when network interface features such as scatter-gather I/O support are not present or enabled on a given network device. In these scenarios, the kernel incorrectly attempts to process transmission requests that rely on direct memory access from dma-buf objects without establishing the required zero-copy binding mechanism. This oversight allows for an invalid state where data offsets within dma-buf structures are treated as valid buffers despite the absence of proper hardware or driver support for such operations.
This technical flaw creates a significant risk because it violates fundamental assumptions made by other parts of the networking stack, particularly regarding fragment management and buffer integrity. The code path relies on strict invariants that assume devmem binding is exclusively present when zero-copy transmission is actively utilized. By allowing non-zero-copy paths to proceed with dma-buf based iovecs, the kernel enables a scenario where network input-output vectors can be mixed with standard page-based fragments within a single socket buffer. This mixing breaks critical internal consistency checks and invariants that prevent data corruption or memory safety violations during packet assembly and transmission processes.
The operational impact of this vulnerability includes potential system instability, unpredictable behavior in network stack processing, and possible exploitation leading to denial-of-service conditions or information disclosure. Attackers who can influence socket buffer configurations might trigger these invalid code paths by crafting specific io_uring requests that specify dma-buf identifiers along with zero-copy flags but omit the actual memory binding step. This mismatch between declared capabilities and actual resource allocation allows for bypassing security checks designed to prevent unsafe memory access patterns. The loose parameter validation previously in place fails to distinguish between legitimate zero-copy configurations and malformed attempts, thereby exposing the system to abuse through carefully crafted network requests that exploit this logical gap.
Mitigation strategies involve applying kernel patches that enforce stricter validation logic within the tcp_sendmsg_locked function. These updates replace overly permissive checks with rigorous verification steps that ensure devmem transmission is only permitted when zero-copy mechanisms are fully established and supported by the underlying hardware interface features. System administrators should prioritize updating to patched versions of the Linux kernel where this logical flaw has been corrected through enhanced input validation for io_uring based network operations. Additionally, monitoring for unusual patterns in socket buffer allocations involving dma-buf references can help detect potential exploitation attempts before they result in system compromise or service disruption.
This vulnerability aligns with CWE-20 Improper Input Validation as the root cause lies in insufficient checking of parameter constraints and state consistency prior to execution. It also relates to CWE-674 Uncontrolled Resource Consumption since improper handling may lead to resource exhaustion through malformed buffer states. From a threat modeling perspective, this falls under ATT&CK technique T1505 Server Software Component which involves the installation or use of malicious software components within server infrastructure, although in this case it represents an unintentional configuration weakness rather than deliberate malware deployment. The fix ensures that only properly bound zero-copy paths are allowed for device memory transmission, thereby restoring expected security boundaries and preventing unauthorized access to kernel memory structures through network layer exploits.