Executive brief
A vulnerability was identified in the Linux kernel's VSOCK implementation, which is used for communication between virtual machines and their hosts. A logic error in how the system manages memory buffers could allow a user to bypass set limits, potentially leading to excessive memory consumption. This could impact system stability or allow a malicious user to interfere with other operations on the same host.
Technical details
A logic error exists in the vsock_update_buffer_size() function within net/vmw_vsock/af_vsock.c. The function incorrectly clamped the buffer size to the maximum value before clamping it to the minimum value. If a user provides a minimum buffer size that is larger than the maximum buffer size, the minimum check overrides the maximum check, allowing vsk->buffer_size to exceed vsk->buffer_max_size. This inversion of constraints can be exploited by a local user to bypass socket memory boundaries. The fix reorders the checks to ensure the minimum is checked first, followed by the maximum.
Affected products
- Linux Linux kernel All versions prior to the fix in May 2026
Timeline
- 2026-04-09: other: Vulnerability identified and patch authored
- 2026-05-28: advisory: CVE-2026-46234 published by NVD
- 2026-05-17: patched: Patch committed to stable kernel trees
References
- https://git.kernel.org/stable/c/0b68881501460c3761f196469e1e503218c5e536
- https://git.kernel.org/stable/c/2602f7bb5818e92315feeaeb71d8ce4d5c9ab160
- https://git.kernel.org/stable/c/310da27932dd0afe7ce7456dfe1f0814c3301f41
- https://git.kernel.org/stable/c/a998a7e250bf976539e05a00ec64a81292afecaa
- https://git.kernel.org/stable/c/d114bfdc9b76bf93b881e195b7ec957c14227bab