---
id: CVE-2026-90051
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tcp: reject non zerocopy devmem tx

  Devmem tcp tx doesn't work without zero-copy, however it's not currently
  enforced if NETIF_F_SG isn't present
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tcp: reject non zerocopy devmem tx

  Devmem tcp tx doesn't work without zero-copy, however it's not currently
  enforced if NETIF_F_SG isn't present. In this case, tcp_sen…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bd61848900bff597764238f3a8ec67c815cd316e <
    2151b2bcf6fcec52665f606eed20da068447f0b7
  - >-
    Linux >= bd61848900bff597764238f3a8ec67c815cd316e <
    b04326c7927af7048fd4e730f5770cca350d0a60
  - >-
    Linux >= bd61848900bff597764238f3a8ec67c815cd316e <
    125755776bc6d4dd53eaf551c87e3d460625d638
  - Linux 6.16
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:39.777'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90051'
references:
  - url: 'https://git.kernel.org/stable/c/125755776bc6d4dd53eaf551c87e3d460625d638'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2151b2bcf6fcec52665f606eed20da068447f0b7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b04326c7927af7048fd4e730f5770cca350d0a60'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00173
epssPercentile: 0.06036
ingestedAt: '2026-09-17T16:21:47.904Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tcp: reject non zerocopy devmem tx

Devmem tcp tx doesn't work without zero-copy, however it's not currently
enforced if NETIF_F_SG isn't present. In this case, tcp_sendmsg_locked()
will try the copy path and try to copy data from an iovec which consists
of offsets into the dma-buf and would normally fail. Moreover,
d9c56501c72fd ("net: tcp: block mixing readable and unreadable frags")
relies on that and assumes that the devmem binding is present IFF we're
using the zero-copy path, which can be used to mix net-iov and pages in
a single skb, and break invariants. Let's reject devmem tx without
zero-copy.

Note, the parameter check the patch is modifying is too loose, we can
create an io_uring request with dmabuf_id and all ZC flags, but which
won't have the binding. We replace it with stricter validation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.