CVE-2026-23057
Use-After-Free in Linux Kernel vsock/virtio Causes Data Loss
Publication date: 2026-02-04
Last updated on: 2026-02-04
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's vsock/virtio component, specifically in how it handles coalescing buffers in the receive (rx) queue. The system tries to join a linear socket buffer (skb) with spare tail room to a small skb if it meets certain size criteria. However, with the introduction of MSG_ZEROCOPY support, the assumption that a small skb is always linear is incorrect. In cases involving zerocopy, data can be lost and the linear skb may be appended with uninitialized kernel memory, leading to potential memory corruption or data leakage.
Only the loopback-transport among the three supported virtio-based transports is affected by this issue. The fix ensures that only linear skbs are coalesced, preventing the problem by verifying that the last skb has tailroom, which guarantees linearity.
How can this vulnerability impact me? :
This vulnerability can lead to data loss and the inclusion of uninitialized kernel memory in network buffers. This may cause memory corruption or leakage of sensitive kernel memory contents, potentially compromising system stability and security.
Since it affects only the loopback transport in virtio-based communication, the impact is limited to local inter-process communication using this transport method. However, exploitation could still lead to unexpected behavior or exposure of sensitive information within the kernel memory.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by ensuring that only linear skbs are coalesced in the vsock/virtio code of the Linux kernel. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.
Specifically, the fix ensures that skb_tailroom(last_skb) > 0 guarantees last_skb is linear, preventing data loss and uninitialized kernel memory exposure.