{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-74627", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-74627" ], "published": "2026-08-22T15:32:12Z", "summary": "net: devmem: prevent net-iov / page mixing", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: devmem: prevent net-iov / page mixing\n\nWe should either have net_iov or page backed frags in a single skb,\notherwise it blows up down the stack. Don't allow mixing in\nzerocopy_fill_skb_from_devmem().", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.45" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.45" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.45" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.45" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74627" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/e9bfe12b1d04c34c6fedcba21d9709b65c08aa33" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/ed08011ae0be88f16cceae190535d6c790c83b0c" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/53a43508ee332d8bffe40590c3d189c92a551f9f" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-25T05:42:41Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The bug is in zerocopy_fill_skb_from_devmem() reached only via local sendmsg() on TCP sockets (tcp_sendmsg_locked -> skb_zerocopy_iter_stream -> __zerocopy_sg_from_iter); remote peers cannot invoke this skb construction path without local process cooperation.\nAC:L - An attacker reliably triggers mixing by partially filling the TCP write-queue tail skb with page-backed zerocopy or copy data, then issuing MSG_ZEROCOPY+SCM_DEVMEM_DMABUF sendmsg on the same skb; no race or uncontrollable layout is required.\nPR:L - Exploitation requires SOCK_ZEROCOPY, netdev-genl NETDEV_CMD_BIND_TX dmabuf binding, and a netmem_tx-capable NIC; CAP_NET_ADMIN for netdev/dmabuf setup is obtainable inside user/network namespaces via unshare without init-namespace root.\nUI:N - No victim file open, mount, or interactive action is needed; the attacker configures devmem TX binding and drives the crafted sendmsg sequence on their own TCP socket.\nS:U - Impact is kernel frag-type confusion and faults during local TX processing on the same host; it does not cross VM, container, or IOMMU security boundaries to a different authority.\nC:H - Mixing page-backed and net_iov frags violates skb unreadability invariants; downstream frag walkers that assume uniform backing can dereference invalid pages via skb_frag_foreach_page, enabling kernel memory disclosure primitives.\nI:H - Creating an skb with both page and net_iov fragments is explicit frag-type confusion; the stack cannot safely manage mixed backing types, and corrupted skb metadata/refcounts can be leveraged for arbitrary kernel writes or control-flow hijacking.\nA:H - The fix commit states mixed frags blow up down the stack; malformed skbs reaching TX, checksum, GSO, or frag-unref paths can trigger kernel oops/panic on netmem_tx deployments (cloud/HPC mlx5, bnxt, gve hosts)." } } }