https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 17:37:13 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90051 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>tcp: reject non zerocopy devmem tx</p> <p>Devmem tcp tx doesn&#39;t work without zero-copy, however it&#39;s not currently enforced if NETIF_F_SG isn&#39;t present. In this case, tcp_sendmsg_locked() will try the copy path and try to copy data from an iovec which consists of offsets into the dma-buf and would normally fail. Moreover, d9c56501c72fd (&#34;net: tcp: block mixing readable and unreadable frags&#34;) relies on that and assumes that the devmem binding is present IFF we&#39;re using the zero-copy path, which can be used to mix net-iov and pages in a single skb, and break invariants. Let&#39;s reject devmem tx without zero-copy.</p> <p>Note, the parameter check the patch is modifying is too loose, we can create an io_uring request with dmabuf_id and all ZC flags, but which won&#39;t have the binding. We replace it with stricter validation.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>tcp: reject non zerocopy devmem tx</p> <p>Devmem tcp tx doesn&#39;t work without zero-copy, however it&#39;s not currently enforced if NETIF_F_SG isn&#39;t present. In this case, tcp_sendmsg_locked() will try the copy path and try to copy data from an iovec which consists of offsets into the dma-buf and would normally fail. Moreover, d9c56501c72fd (&#34;net: tcp: block mixing readable and unreadable frags&#34;) relies on that and assumes that the devmem binding is present IFF we&#39;re using the zero-copy path, which can be used to mix net-iov and pages in a single skb, and break invariants. Let&#39;s reject devmem tx without zero-copy.</p> <p>Note, the parameter check the patch is modifying is too loose, we can create an io_uring request with dmabuf_id and all ZC flags, but which won&#39;t have the binding. We replace it with stricter validation.</p> https://vulnerability.circl.lu/vuln/cve-2026-90051