CVE-2026-23069
Unknown Unknown - Not Provided
Integer Underflow in Linux Kernel vsock virtio Credit Calculation

Publication date: 2026-02-04

Last updated on: 2026-03-13

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential underflow in virtio_transport_get_credit() The credit calculation in virtio_transport_get_credit() uses unsigned arithmetic: ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes are in flight, the subtraction can underflow and produce a large positive value, potentially allowing more data to be queued than the peer can handle. Reuse virtio_transport_has_space() which already handles this case and add a comment to make it clear why we are doing that. [Stefano: use virtio_transport_has_space() instead of duplicating the code] [Stefano: tweak the commit message]
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-04
Last Modified
2026-03-13
Generated
2026-06-16
AI Q&A
2026-02-04
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23069
Affected Vendors & Products
Showing 10 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel From 6.2 (inc) to 6.6.122 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.68 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.8 (exc)
linux linux_kernel 6.19
linux linux_kernel From 4.8 (inc) to 6.1.162 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's vsock/virtio component, specifically in the function virtio_transport_get_credit(). The function calculates credits using unsigned arithmetic, which can lead to an underflow when the peer reduces its advertised buffer size while data is still in transit. This underflow causes the calculation to produce a large positive value, potentially allowing more data to be queued than the peer can handle.

The issue is fixed by reusing the function virtio_transport_has_space(), which already handles this case correctly, and by adding comments to clarify the reasoning.

Detection Guidance

I don't know

Impact Analysis

This vulnerability can impact you by allowing more data to be queued than the peer system can handle. This could potentially lead to resource exhaustion or unexpected behavior in communication between virtual sockets, possibly causing performance degradation or instability in systems relying on the affected Linux kernel component.

Compliance Impact

I don't know

Mitigation Strategies

The vulnerability has been resolved by fixing the potential underflow in the Linux kernel's virtio_transport_get_credit() function.

To mitigate this vulnerability, update your Linux kernel to a version that includes the fix where virtio_transport_has_space() is used instead of duplicating the vulnerable code.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23069. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart