CVE-2026-90051

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the TCP implementation where devmem TX is not properly enforced to require zero-copy when NETIF F SG is absent. In such scenarios, the tcp sendmsg locked() function attempts a copy path using an iovec containing offsets into the dma-buf, which typically fails. This behavior can lead to the mixing of net-iov and pages within a single skb, breaking internal invariants. Additionally, loose parameter validation allows the creation of io uring requests with dmabuf id and zero-copy flags without the necessary binding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.