CVE-2026-23057: vsock/virtio: Coalesce only linear skb
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: Coalesce only linear skb
vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOODCOPYLEN = 128), an attempt is made to join them.
Since the introduction of MSGZEROCOPY support, assumption that a small skb will always be linear is incorrect. In the zerocopy case, data is lost and the linear skb is appended with uninitialized kernel memory.
Of all 3 supported virtio-based transports, only loopback-transport is affected. G2H virtio-transport rx queue operates on explicitly linear skbs; see virtiovsockalloclinearskb() in virtiovsockrxfill(). H2G vhost-transport may allocate non-linear skbs, but only for sizes that are not considered for coalescence; see PAGEALLOCCOSTLYORDER in virtiovsockallocskb().
Ensure only linear skbs are coalesced. Note that skbtailroom(lastskb) > 0 guarantees lastskb is linear.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Configuration
Ensure that only linear skbs are coalesced in the virtio transport receive queue.
vsock/virtio skb coalescing = only linear skbs
Event History
Frequently Asked Questions
Which virtio-based vsock deployments are affected?
Only the loopback virtio transport is affected. Guest-to-host virtio transport and host-to-guest vhost transport are not affected by this coalescing condition.
What condition triggers the issue?
The receive queue must attempt to coalesce a linear skb with spare tail room followed by a small non-linear skb. MSG_ZEROCOPY support makes such small non-linear skbs possible; in this case, data can be lost and uninitialized kernel memory can be appended to the linear skb.