Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to bypass memory locking limits. This component is responsible for efficient data transfer between virtual machines and the host. An attacker could exploit this to consume more system memory than permitted, potentially leading to a denial-of-service condition on the host system.
Technical details
A logic error in the Linux kernel's vsock/virtio implementation leads to incorrect pinned-pages accounting during MSG_ZEROCOPY operations. The function virtio_transport_init_zcopy_skb() incorrectly used an iterator count that had already been consumed by virtio_transport_fill_skb(). Consequently, the size argument passed to msg_zerocopy_realloc() would be zero on the final socket buffer, causing the kernel to skip RLIMIT_MEMLOCK enforcement. This allows a local attacker to pin more memory than allowed by system policy. The issue has been resolved by passing the total packet length explicitly to ensure accurate accounting. Fixes are available in stable kernel branches including 6.18.33, 7.0.10, and 7.1.
Affected products
- Linux Linux Kernel 6.7 to 7.1
Timeline
- 2026-04-20: other: Patch authored
- 2026-06-24: disclosed: CVE published