CVE-2026-23069

Unknown Unknown - Not Provided

Integer Underflow in Linux Kernel vsock virtio Credit Calculation

Publication date: 2026-02-04

Last updated on: 2026-03-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential underflow in virtio_transport_get_credit() The credit calculation in virtio_transport_get_credit() uses unsigned arithmetic: ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes are in flight, the subtraction can underflow and produce a large positive value, potentially allowing more data to be queued than the peer can handle. Reuse virtio_transport_has_space() which already handles this case and add a comment to make it clear why we are doing that. [Stefano: use virtio_transport_has_space() instead of duplicating the code] [Stefano: tweak the commit message]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-04

Last Modified

2026-03-13

Generated

2026-07-06

AI Q&A

2026-02-04

EPSS Evaluated

2026-07-05

NVD

CVE-2026-23069

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	From 6.2 (inc) to 6.6.122 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.68 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.8 (exc)
linux	linux_kernel	6.19
linux	linux_kernel	From 4.8 (inc) to 6.1.162 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Detection Guidance

I don't know

Executive Summary

This vulnerability exists in the Linux kernel's vsock/virtio component, specifically in the function virtio_transport_get_credit(). The function calculates credits using unsigned arithmetic, which can lead to an underflow when the peer reduces its advertised buffer size while data is still in transit. This underflow causes the calculation to produce a large positive value, potentially allowing more data to be queued than the peer can handle.

The issue is fixed by reusing the function virtio_transport_has_space(), which already handles this case correctly, and by adding comments to clarify the reasoning.

Impact Analysis

This vulnerability can impact you by allowing more data to be queued than the peer system can handle. This could potentially lead to resource exhaustion or unexpected behavior in communication between virtual sockets, possibly causing performance degradation or instability in systems relying on the affected Linux kernel component.

Compliance Impact

I don't know

Mitigation Strategies

The vulnerability has been resolved by fixing the potential underflow in the Linux kernel's virtio_transport_get_credit() function.

To mitigate this vulnerability, update your Linux kernel to a version that includes the fix where virtio_transport_has_space() is used instead of duplicating the vulnerable code.

Hi! I’m here to help you understand CVE-2026-23069. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70