Executive brief
A vulnerability was identified in the Linux kernel's networking component used for communication between virtual machines and their hosts. Under specific conditions involving high-volume data transfers, the system could incorrectly handle memory cleanup during a failed operation. This could lead to system instability or memory management issues, potentially impacting the reliability of virtualized environments.
Technical details
A vulnerability in the Linux kernel's vsock/virtio implementation arises from an incorrect binding sequence of the zerocopy user argument (uarg). In `virtio_transport_send_pkt_info()`, the `skb` is filled before it inherits the `uarg`. If a fixed-buffer vectored zerocopy operation hits `MAX_SKB_FRAGS`, `io_sg_from_iter()` may return an error after partially attaching managed fragments. The subsequent rollback path calls `kfree_skb()` on an `skb` that lacks the `uarg` but carries the `SKBFL_MANAGED_FRAG_REFS` flag, causing `skb_release_data()` to perform an ordinary fragment unreference instead of the required uarg-aware cleanup. This results in incorrect memory lifetime management. The fix involves passing the `uarg` into `virtio_transport_alloc_skb()` to ensure it is bound before the `skb` is filled.
Affected products
- Linux Linux Kernel 6.7 to 7.1
Timeline
- 2026-05-27: other: Patch authored
- 2026-07-19: disclosed: CVE published