Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically affecting how it handles high-efficiency data transfers (zerocopy) between virtual machines and their hosts. When large messages are sent, the system may fail to properly track memory pages, leading to memory leaks or situations where the system cannot notify applications that data has been successfully sent. This could potentially impact system stability or cause applications to malfunction due to exhausted memory resources.
Technical details
A vulnerability in the Linux kernel's vsock/virtio transport implementation (net/vmw_vsock/virtio_transport_common.c) arises from improper handling of the zerocopy uarg during multi-skb (socket buffer) sends. When a large message is fragmented, the uarg is only attached to the final skb, leaving non-final skbs with pinned user pages but no completion tracking. If the send loop terminates prematurely, the uarg is never allocated, resulting in a leak of pinned pages and a lack of completion notification to userspace. The fix involves pre-allocating the uarg and attaching it to every skb in the sequence, ensuring proper reference counting and notification. Patches have been released for stable kernel branches including 6.18.34 and 7.0.11.
Affected products
- Linux Linux Kernel 6.7 to 6.18.33, 7.0.0 to 7.0.10
Timeline
- 2026-05-14: disclosed: Initial patch submission by Stefano Garzarella
- 2026-06-01: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-07-13: advisory: CVE-2026-53365 published by NVD