In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: fix MSGZEROCOPY pinned-pages accounting

virtiotransportinitzcopyskb() uses iter->count as the size argument for msgzerocopyrealloc(), which in turn passes it to mmaccountpinnedpages() for RLIMITMEMLOCK accounting. However, this function is called after virtiotransportfillskb() has already consumed the iterator via zerocopysgfromiter(), so on the last skb, iter->count will be 0, skipping the RLIMITMEMLOCK enforcement.

Pass pktlen (the total bytes being sent) as an explicit parameter to virtiotransportinitzcopyskb() instead of reading the already-consumed iter->count.

This matches TCP and UDP, which both call msgzerocopyrealloc() with the original message size.

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: fix accept queue count leak on transport mismatch

virtiotransportrecvlisten() calls skacceptqadded() before vsockassigntransport(). If vsockassigntransport() fails or selects a different transport, the error path returns without calling skacceptqremoved(), permanently incrementing skackbacklog.

After approximately backlog+1 such failures, skacceptqisfull() returns true, causing the listener to reject all new connections.

Fix by moving skacceptqadded() to after the transport validation, matching the pattern used by vmcitransport and hypervtransport.