CVE-2026-63970

Analyzed Analyzed - Analysis Complete

Heap-based Buffer Overflow in Linux Kernel vsock/virtio

Publication date: 2026-07-19

Last updated on: 2026-10-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: bind uarg before filling zerocopy skb virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg before entering the send loop, but virtio_transport_alloc_skb() still fills the skb before it inherits that uarg. When fixed-buffer vectored zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach managed frags and return -EMSGSIZE. The rollback path call kfree_skb() to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so skb_release_data() falls through to ordinary frag unref. Pass the uarg into virtio_transport_alloc_skb() and bind it immediately before virtio_transport_fill_skb(). This keeps control or no-payload skbs untouched while ensuring success and rollback share one lifetime rule.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-02

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-08

NVD

CVE-2026-63970

EUVD

EUVD-2026-45743

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.97 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the vsock/virtio subsystem. The issue occurs when sending packets with zerocopy enabled. The function virtio_transport_send_pkt_info() allocates or reuses a zerocopy uarg before the send loop, but virtio_transport_alloc_skb() fills the skb before inheriting that uarg. When zerocopy hits a limit, the rollback path frees an skb without proper uarg handling, leading to incorrect frag reference cleanup.

Detection Guidance

This vulnerability is specific to the Linux kernel's vsock/virtio implementation and may not have direct detection commands. Monitor kernel logs for errors related to vsock or virtio, such as skb-related warnings or crashes. Check for unusual network activity or kernel panics involving virtio_transport_send_pkt_info or virtio_transport_alloc_skb functions.

Impact Analysis

This vulnerability could cause kernel memory corruption or crashes during network operations involving vsock/virtio. Systems using affected Linux kernel versions may experience instability, data corruption, or denial of service when handling zerocopy socket operations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a low-level Linux kernel networking issue involving vsock/virtio socket handling. No data exposure or privacy implications are described in the provided context.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling vsock/virtio functionality temporarily if it is not critical to your operations. Monitor vendor advisories for kernel updates addressing this issue.

Hi! I’m here to help you understand CVE-2026-63970. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70