EUVD-2026-64564
GHSA-78h9-c595-34hg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the non-default prerequisite of devmem TCP zero-copy being actively configured; PR:L aligns with low-privilege local triggering once that condition is met.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: devmem: prevent net-iov / page mixing
We should either have net_iov or page backed frags in a single skb, otherwise it blows up down the stack. Don't allow mixing in zerocopy_fill_skb_from_devmem().
AnalysisAI
Linux kernel zero-copy networking in zerocopy_fill_skb_from_devmem() permits improper mixing of net_iov (device memory) and page-backed fragments within a single socket buffer (skb), causing type confusion and memory corruption in downstream kernel networking code. Affected are kernels from introducing commit bd61848900bff5 across the 6.18.x and 7.x stable series until the respective patch commits were applied. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Linux kernel's devmem TCP zero-copy feature to be actively enabled and configured on the target system - this involves hardware support for device memory (DMA buffer-backed networking), appropriate kernel build options, and deliberate application-level use of devmem socket APIs such as SO_DEVMEM_* socket options. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) reflects local kernel-level impact with potentially severe memory corruption consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local low-privileged user on a host with devmem TCP zero-copy configured and active uses socket operations to cause zerocopy_fill_skb_from_devmem() to build a socket buffer containing both net_iov-backed and page-backed fragment types. When the kernel networking stack subsequently processes this malformed skb, type confusion in fragment handling triggers kernel memory corruption or a kernel panic. … |
| Remediation | Upgrade to a patched Linux kernel: 7.2 or later for mainline, 7.1.9 or later for the 7.1.x stable track, or 6.18.45 or later for the 6.18.x stable track. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit systems running Linux kernels 6.18.x or 7.x series to identify which have devmem TCP zero-copy configured and enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today