CVE-2026-63970
Received Received - Intake

Heap-based Buffer Overflow in Linux Kernel vsock/virtio

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: bind uarg before filling zerocopy skb virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg before entering the send loop, but virtio_transport_alloc_skb() still fills the skb before it inherits that uarg. When fixed-buffer vectored zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach managed frags and return -EMSGSIZE. The rollback path call kfree_skb() to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so skb_release_data() falls through to ordinary frag unref. Pass the uarg into virtio_transport_alloc_skb() and bind it immediately before virtio_transport_fill_skb(). This keeps control or no-payload skbs untouched while ensuring success and rollback share one lifetime rule.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63970
EUVD
EUVD-2026-45743

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the vsock/virtio subsystem. The issue occurs when sending packets with zerocopy enabled. The function virtio_transport_send_pkt_info() allocates or reuses a zerocopy uarg before the send loop, but virtio_transport_alloc_skb() fills the skb before inheriting that uarg. When zerocopy hits a limit, the rollback path frees an skb without proper uarg handling, leading to incorrect frag reference cleanup.

Detection Guidance

This vulnerability is specific to the Linux kernel's vsock/virtio implementation and may not have direct detection commands. Monitor kernel logs for errors related to vsock or virtio, such as skb-related warnings or crashes. Check for unusual network activity or kernel panics involving virtio_transport_send_pkt_info or virtio_transport_alloc_skb functions.

Impact Analysis

This vulnerability could cause kernel memory corruption or crashes during network operations involving vsock/virtio. Systems using affected Linux kernel versions may experience instability, data corruption, or denial of service when handling zerocopy socket operations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a low-level Linux kernel networking issue involving vsock/virtio socket handling. No data exposure or privacy implications are described in the provided context.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling vsock/virtio functionality temporarily if it is not critical to your operations. Monitor vendor advisories for kernel updates addressing this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63970. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart