Executive brief
A vulnerability was identified in the Linux kernel's virtio vsock implementation where network monitoring data could be left uninitialized. When capturing traffic via the vsockmon tap device, certain data buffers were not correctly populated with the actual network payload. This could lead to the exposure of stale or uninitialized kernel memory to monitoring tools, potentially leaking sensitive information to local users with packet capture privileges.
Technical details
A vulnerability in the Linux kernel's vsock/virtio implementation stems from an improperly initialized iov_iter in the virtio_transport_copy_nonlinear_skb() function. When handling non-linear socket buffers (skbs) for delivery to the vsockmon tap device, the iov_iter.count field was not set, resulting in a zero-length copy. This leaves the destination buffer uninitialized, potentially exposing kernel memory to the monitor interface. The issue was resolved by unifying the linear and non-linear buffer handling using skb_copy_datagram_iter() with properly initialized iterators. The fix has been backported to multiple stable kernel branches.
Affected products
- Linux Linux kernel virtio_transport_common.c
Timeline
- 2026-05-08: disclosed: Initial patch submission by Stefano Garzarella
- 2026-05-28: advisory: CVE-2026-46207 published by NVD