7.8

CVE-2026-63970

vsock/virtio: bind uarg before filling zerocopy skb

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: bind uarg before filling zerocopy skb

virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg
before entering the send loop, but virtio_transport_alloc_skb() still
fills the skb before it inherits that uarg. When fixed-buffer vectored
zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach
managed frags and return -EMSGSIZE. The rollback path call kfree_skb()
to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so
skb_release_data() falls through to ordinary frag unref.

Pass the uarg into virtio_transport_alloc_skb() and bind it immediately
before virtio_transport_fill_skb(). This keeps control or no-payload skbs
untouched while ensuring success and rollback share one lifetime rule.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 581512a6dc939ef122e49336626ae159f3b8a345
Version < 72194f65050958e4c8e069adb6c5d89ef81ca197
Status affected
Version 581512a6dc939ef122e49336626ae159f3b8a345
Version < b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d
Status affected
Version 581512a6dc939ef122e49336626ae159f3b8a345
Version < 5d317573f1d48e76cce5fb6250452b6e4102e0fb
Status affected
Version 581512a6dc939ef122e49336626ae159f3b8a345
Version < 1e584c304cfb94a759417130b1fc6d30b30c4cce
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.7
Status affected
Version 0
Version < 6.7
Status unaffected
Version <= 6.12.*
Version 6.12.97
Status unaffected
Version <= 6.18.*
Version 6.18.35
Status unaffected
Version <= 7.0.*
Version 7.0.12
Status unaffected
Version <= *
Version 7.1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.072
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d
https://git.kernel.org/stable/c/5d317573f1d48e76cce5fb6250452b6e4102e0fb
https://git.kernel.org/stable/c/1e584c304cfb94a759417130b1fc6d30b30c4cce
https://git.kernel.org/stable/c/72194f65050958e4c8e069adb6c5d89ef81ca197