CVE-2026-74627 Overview
CVE-2026-74627 is a Linux kernel vulnerability in the device memory (devmem) networking subsystem. The flaw allows the mixing of net_iov and page-backed fragments within a single socket buffer (skb). The kernel expects an skb to contain either net_iov or page-backed frags exclusively. Mixing the two fragment types causes downstream code paths to fail, leading to kernel instability. The issue was resolved by rejecting mixed fragment types in zerocopy_fill_skb_from_devmem().
Critical Impact
A local, low-privileged user can trigger memory corruption or kernel panic in the networking stack by crafting zerocopy sends that mix devmem net_iov fragments with page-backed fragments, threatening confidentiality, integrity, and availability of the host.
Affected Products
- Linux kernel branches containing the devmem TCP / net_iov zerocopy send path
- Distributions shipping affected upstream Linux kernel versions
- Stable trees receiving the fix commits 53a43508, e9bfe12b, and ed08011a
Discovery Timeline
- 2026-08-22 - CVE-2026-74627 published to the National Vulnerability Database
- 2026-08-25 - Last updated in the NVD database
Technical Details for CVE-2026-74627
Vulnerability Analysis
The Linux kernel supports device memory TCP (devmem TCP), which allows network payloads to reference GPU or accelerator memory through net_iov descriptors instead of standard page-backed fragments. The zerocopy_fill_skb_from_devmem() function populates skb fragments from user-supplied devmem regions during zerocopy sendmsg() operations.
The fix enforces that a single skb must contain fragments of one backing type. Without this constraint, an skb could carry both net_iov references and traditional page-backed frags. Downstream code in the transmit and cleanup paths dereferences fragments assuming a uniform backing type. Mixed fragments cause type confusion when the kernel invokes page-specific helpers on net_iov entries, resulting in kernel oops, memory corruption, or exploitable state.
Root Cause
The root cause is missing input validation in the devmem zerocopy send path. zerocopy_fill_skb_from_devmem() did not verify that existing skb fragments were of the same backing type before appending net_iov frags. This is a fragment type confusion issue within the kernel networking layer.
Attack Vector
Exploitation requires local access with the ability to open sockets and use MSG_ZEROCOPY with a devmem-bound region. An attacker constructs a sendmsg() sequence that first attaches page-backed data, then appends devmem net_iov fragments to the same skb. The mismatched fragments propagate down the stack, corrupting kernel state or crashing the host. The exploitation code cannot be reproduced here; refer to the upstream commits 53a43508ee33, e9bfe12b1d04, and ed08011ae0be for the patched validation logic.
Detection Methods for CVE-2026-74627
Indicators of Compromise
- Kernel oops or panic entries in dmesg referencing zerocopy_fill_skb_from_devmem, skb_frag, or net_iov helpers
- Unexpected process terminations for workloads using MSG_ZEROCOPY with devmem TCP bindings
- Repeated sendmsg() calls from unprivileged processes targeting sockets with devmem regions attached
Detection Strategies
- Audit kernel version inventory to identify hosts running Linux builds without the fix commits 53a43508, e9bfe12b, or ed08011a
- Enable kernel address sanitizer (KASAN) in test environments to surface fragment type confusion during regression testing
- Correlate kernel crash telemetry with local user activity to identify probing of the devmem send path
Monitoring Recommendations
- Forward /var/log/kern.log and journalctl -k output to a centralized log platform for kernel fault analysis
- Alert on unexpected use of SO_ZEROCOPY and SO_DEVMEM_* socket options by non-privileged workloads
- Track host uptime anomalies and unplanned reboots on systems exposing devmem TCP to tenants
How to Mitigate CVE-2026-74627
Immediate Actions Required
- Apply the upstream fix by updating to a Linux kernel that includes commits 53a43508ee33, e9bfe12b1d04, and ed08011ae0be
- Restrict local shell access on multi-tenant hosts running kernels with devmem TCP enabled
- Disable devmem TCP features on systems that do not require GPU-direct or accelerator zerocopy networking
Patch Information
The fix is available in the following upstream Linux kernel commits: Kernel Git Commit 53a4350, Kernel Git Commit e9bfe12, and Kernel Git Commit ed08011. Track your distribution's kernel security advisory feed for backported package releases.
Workarounds
- Rebuild the kernel without CONFIG_NET_DEVMEM where the feature is not required
- Apply seccomp or Linux Security Module policies that block MSG_ZEROCOPY on sendmsg() for untrusted processes
- Limit CAP_NET_ADMIN and access to devmem-capable network devices to trusted service accounts only
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
