CVE-2026-53132

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel vsock/virtio

Publication date: 2026-06-25

Last updated on: 2026-07-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential unbounded skb queue virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. virtio_transport_recv_enqueue() skips coalescing for packets with VIRTIO_VSOCK_SEQ_EOM. If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, a very large number of packets can be queued because vvs->rx_bytes stays at 0. Fix this by estimating the skb metadata size: (Number of skbs in the queue) * SKB_TRUESIZE(0)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-06

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53132

EUVD

EUVD-2026-39337

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.3
linux	linux_kernel	6.3
linux	linux_kernel	6.3
linux	linux_kernel	6.3
linux	linux_kernel	6.3
linux	linux_kernel	6.3
linux	linux_kernel	From 6.1.63 (inc) to 6.2 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	From 6.3.1 (inc) to 6.12.94 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's vsock/virtio component, where a potential unbounded skb (socket buffer) queue can occur.

The issue arises because the function virtio_transport_inc_rx_pkt() checks if the sum of received bytes plus the length of a new packet exceeds a buffer allocation limit, but packets with length zero and a specific flag (VIRTIO_VSOCK_SEQ_EOM) can bypass normal coalescing and queuing limits.

As a result, a very large number of such zero-length packets can be queued indefinitely since the received bytes counter does not increase, potentially leading to resource exhaustion.

The fix involves estimating the skb metadata size by multiplying the number of skbs in the queue by a constant size (SKB_TRUESIZE(0)) to properly limit the queue.

Impact Analysis

This vulnerability can lead to an unbounded queue of socket buffers in the Linux kernel, which may cause resource exhaustion such as memory consumption.

If exploited, it could degrade system performance or potentially cause denial of service by exhausting kernel memory resources.

Hi! I’m here to help you understand CVE-2026-53132. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70