Executive brief
The Linux kernel's vhost-net module, which enables high-performance network I/O virtualization for virtual machines, contains a memory safety vulnerability in its zerocopy packet completion logic. When network packets are cloned during processing (e.g., by fragmentation), the kernel may free memory while other parts of the code still hold references to it, leading to a use-after-free condition. An attacker with the ability to trigger network fragmentation could crash the host kernel or potentially execute arbitrary code, disrupting all virtual machines running on the host.
Technical details
The vulnerability is a use-after-free (CWE-416) in the vhost_zerocopy_complete() function within the Linux kernel's vhost-net module. The root cause is improper reference counting of ubuf_info objects when zerocopy skbs are cloned by the networking stack (e.g., via batman-adv fragmentation or veth forwarding). The function treats every ubuf callback as a completed descriptor without checking if other skb clones still reference the same ubuf_info, and completes the vhost state while cloned skbs retain the same ubuf pointer. When backend reset frees the ubuf_info via kfree_rcu() while a cloned skb still holds a reference, subsequent skb completion triggers a use-after-free dereference. No special authentication or privileges are required; the vector requires network-reachable conditions and can be triggered through packet fragmentation during normal network processing. The fix honors the generic ubuf_info refcount before touching vhost state and runs descriptor completion only for the final ubuf reference.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-15: disclosed
- 2026-08-15: patched: Patch resolves use-after-free by honoring ubuf_info refcount before vhost state completion