CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: fix MSGZEROCOPY pinned-pages accounting
virtiotransportinitzcopyskb() uses iter->count as the size argument for msgzerocopyrealloc(), which in turn passes it to mmaccountpinnedpages() for RLIMITMEMLOCK accounting. However, this function is called after virtiotransportfillskb() has already consumed the iterator via zerocopysgfromiter(), so on the last skb, iter->count will be 0, skipping the RLIMITMEMLOCK enforcement.
Pass pktlen (the total bytes being sent) as an explicit parameter to virtiotransportinitzcopyskb() instead of reading the already-consumed iter->count.
This matches TCP and UDP, which both call msgzerocopyrealloc() with the original message size.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52994?
CVE-2026-52994 has a severity rating of medium with a score of 5.5.
How do I fix CVE-2026-52994?
To fix CVE-2026-52994, apply the available patches to the Linux kernel that address the vulnerability.
What does CVE-2026-52994 affect?
CVE-2026-52994 affects the Linux kernel, specifically the vsock and virtio components.
What is the risk level of CVE-2026-52994?
CVE-2026-52994 has a risk level of 32, indicating a notable impact under certain conditions.
What is the nature of the vulnerability in CVE-2026-52994?
CVE-2026-52994 involves an issue with MSG_ZEROCOPY pinned-pages accounting in the Linux kernel's handling of virtio transport.