Junglewise Threat Intelligence

CVE-2026-63970: Linux Kernel vsock/virtio memory management error in zerocopy skb

CVE-2026-63970 · Severity: info · CVSS 0 · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's networking component used for communication between virtual machines and their hosts. Under specific conditions involving high-volume data transfers, the system could incorrectly handle memory cleanup during a failed operation. This could lead to system instability or memory management issues, potentially impacting the reliability of virtualized environments.

Technical details

A vulnerability in the Linux kernel's vsock/virtio implementation arises from an incorrect binding sequence of the zerocopy user argument (uarg). In `virtio_transport_send_pkt_info()`, the `skb` is filled before it inherits the `uarg`. If a fixed-buffer vectored zerocopy operation hits `MAX_SKB_FRAGS`, `io_sg_from_iter()` may return an error after partially attaching managed fragments. The subsequent rollback path calls `kfree_skb()` on an `skb` that lacks the `uarg` but carries the `SKBFL_MANAGED_FRAG_REFS` flag, causing `skb_release_data()` to perform an ordinary fragment unreference instead of the required uarg-aware cleanup. This results in incorrect memory lifetime management. The fix involves passing the `uarg` into `virtio_transport_alloc_skb()` to ensure it is bound before the `skb` is filled.

Affected products

  • Linux Linux Kernel 6.7 to 7.1

Timeline

  • 2026-05-27: other: Patch authored
  • 2026-07-19: disclosed: CVE published

References

Related threats