In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: bind uarg before filling zerocopy skb
virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg
before entering the send loop, but virtio_transport_alloc_skb() still
fills the skb before it inherits that uarg. When fixed-buffer vectored
zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach
managed frags and return -EMSGSIZE. The rollback path call kfree_skb()
to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so
skb_release_data() falls through to ordinary frag unref.
Pass the uarg into virtio_transport_alloc_skb() and bind it immediately
before virtio_transport_fill_skb(). This keeps control or no-payload skbs
untouched while ensuring success and rollback share one lifetime rule.
References
Configurations
Configuration 1 (hide)
|
History
19 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-401 |
02 Oct 2026, 19:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/1e584c304cfb94a759417130b1fc6d30b30c4cce - Patch | |
| References | () https://git.kernel.org/stable/c/5d317573f1d48e76cce5fb6250452b6e4102e0fb - Patch | |
| References | () https://git.kernel.org/stable/c/72194f65050958e4c8e069adb6c5d89ef81ca197 - Patch | |
| References | () https://git.kernel.org/stable/c/b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d - Patch | |
| First Time |
Linux
Linux linux Kernel |
|
| CWE | CWE-416 |
Information
Published : 2026-07-19 16:17
Updated : 2026-10-19 21:17
NVD link : CVE-2026-63970
Mitre link : CVE-2026-63970
CVE.ORG link : CVE-2026-63970
JSON object : View
Products Affected
linux
- linux_kernel