In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy,… (CVE-2026-90051)
A high-severity vulnerability in the Linux kernel TCP stack involves improper handling of devmem TCP transmit without zero-copy enforcement. This flaw allows tcp_sendmsg_locked() to attempt copying data from an iovec referencing dma-buf offsets, which normally fails and can break internal invariants. The vulnerability arises because the kernel does not strictly enforce zero-copy requirements when NETIF_F_SG is absent, leading to potential mixing of readable and unreadable fragments in a single socket buffer. A stricter validation patch has been applied to reject devmem transmission without zero-copy, addressing this issue.
AI Analysis
Technical Summary
The Linux kernel TCP implementation had a vulnerability where devmem TCP transmit operations were not properly restricted to zero-copy paths. Without enforcing zero-copy when NETIF_F_SG is missing, tcp_sendmsg_locked() attempts to copy data from iovec structures containing offsets into dma-bufs, which is invalid and causes failures. Additionally, a prior commit assumed devmem binding presence only with zero-copy, enabling mixing of net-iov and pages in one skb and breaking kernel invariants. The fix introduces stricter validation to reject devmem transmission without zero-copy, preventing these inconsistent states.
Potential Impact
This vulnerability can cause kernel TCP transmit operations to fail or behave inconsistently due to invalid memory copying attempts, potentially leading to denial of service or corruption of network data handling. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild at this time.
Mitigation Recommendations
A patch has been applied to the Linux kernel that enforces stricter validation, rejecting devmem TCP transmit operations without zero-copy. Users should update to the fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation. Patch status is not explicitly stated but the description confirms the vulnerability has been resolved.
In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy,… (CVE-2026-90051)
Description
A high-severity vulnerability in the Linux kernel TCP stack involves improper handling of devmem TCP transmit without zero-copy enforcement. This flaw allows tcp_sendmsg_locked() to attempt copying data from an iovec referencing dma-buf offsets, which normally fails and can break internal invariants. The vulnerability arises because the kernel does not strictly enforce zero-copy requirements when NETIF_F_SG is absent, leading to potential mixing of readable and unreadable fragments in a single socket buffer. A stricter validation patch has been applied to reject devmem transmission without zero-copy, addressing this issue.
CVSS v3.1
Score 7.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel TCP implementation had a vulnerability where devmem TCP transmit operations were not properly restricted to zero-copy paths. Without enforcing zero-copy when NETIF_F_SG is missing, tcp_sendmsg_locked() attempts to copy data from iovec structures containing offsets into dma-bufs, which is invalid and causes failures. Additionally, a prior commit assumed devmem binding presence only with zero-copy, enabling mixing of net-iov and pages in one skb and breaking kernel invariants. The fix introduces stricter validation to reject devmem transmission without zero-copy, preventing these inconsistent states.
Potential Impact
This vulnerability can cause kernel TCP transmit operations to fail or behave inconsistently due to invalid memory copying attempts, potentially leading to denial of service or corruption of network data handling. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild at this time.
Mitigation Recommendations
A patch has been applied to the Linux kernel that enforces stricter validation, rejecting devmem TCP transmit operations without zero-copy. Users should update to the fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel update is the recommended remediation. Patch status is not explicitly stated but the description confirms the vulnerability has been resolved.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8gg6-pfjx-8vr5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90051"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aade52a55bf5e2cf5edc1d4
Added to database: 09/19/2026, 01:28:10 UTC
Last enriched: 09/19/2026, 01:55:27 UTC
Last updated: 09/19/2026, 03:03:27 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.