CVE-2026-23057
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: Coalesce only linear skb
vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOOD_COPY_LEN = 128), an attempt is made to join them.
Since the introduction of MSG_ZEROCOPY support, assumption that a small skb will always be linear is incorrect. In the zerocopy case, data is lost and the linear skb is appended with uninitialized kernel memory.
Of all 3 supported virtio-based transports, only loopback-transport is affected.
Leer descripción completaMostrar menos
G2H virtio-transport rx queue operates on explicitly linear skbs; see virtio_vsock_alloc_linear_skb() in virtio_vsock_rx_fill(). H2G vhost-transport may allocate non-linear skbs, but only for sizes that are not considered for coalescence; see PAGE_ALLOC_COSTLY_ORDER in virtio_vsock_alloc_skb().
Ensure only linear skbs are coalesced. Note that skb_tailroom(last_skb) > 0 guarantees last_skb is linear.
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.19%
- Percentil entre todas las CVEs puntuadas: 8
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-23057",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "581512a6dc939ef122e49336626ae159f3b8a345",
"lessThan": "568e9cd8ed7ca9bf748c7687ba6501f29d30e59f",
"versionType": "git"
},
{
"status": "affected",
"version": "581512a6dc939ef122e49336626ae159f3b8a345",
"lessThan": "63ef9b300bd09e24c57050c5dbe68feedce42e72",
"versionType": "git"
},
{
"status": "affected",
"version": "581512a6dc939ef122e49336626ae159f3b8a345",
"lessThan": "0386bd321d0f95d041a7b3d7b07643411b044a96",
"versionType": "git"
}
],
"programFiles": [
"net/vmw_vsock/virtio_transport_common.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.68",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.8",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/vmw_vsock/virtio_transport_common.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-02-04T17:16:16.380",
"references": [
{
"url": "https://git.kernel.org/stable/c/0386bd321d0f95d041a7b3d7b07643411b044a96",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/568e9cd8ed7ca9bf748c7687ba6501f29d30e59f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/63ef9b300bd09e24c57050c5dbe68feedce42e72",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Deferred",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: Coalesce only linear skb\n\nvsock/virtio common tries to coalesce buffers in rx queue: if a linear skb\n(with a spare tail room) is followed by a small skb (length limited by\nGOOD_COPY_LEN = 128), an attempt is made to join them.\n\nSince the introduction of MSG_ZEROCOPY support, assumption that a small skb\nwill always be linear is incorrect. In the zerocopy case, data is lost and\nthe linear skb is appended with uninitialized kernel memory.\n\nOf all 3 supported virtio-based transports, only loopback-transport is\naffected. G2H virtio-transport rx queue operates on explicitly linear skbs;\nsee virtio_vsock_alloc_linear_skb() in virtio_vsock_rx_fill(). H2G\nvhost-transport may allocate non-linear skbs, but only for sizes that are\nnot considered for coalescence; see PAGE_ALLOC_COSTLY_ORDER in\nvirtio_vsock_alloc_skb().\n\nEnsure only linear skbs are coalesced. Note that skb_tailroom(last_skb) > 0\nguarantees last_skb is linear."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvsock/virtio: Coalescer solo skb lineal\n\nEl común de vsock/virtio intenta coalescer búferes en la cola rx: si un skb lineal (con espacio de cola libre) es seguido por un skb pequeño (longitud limitada por GOOD_COPY_LEN = 128), se intenta unirlos.\n\nDesde la introducción del soporte MSG_ZEROCOPY, la suposición de que un skb pequeño siempre será lineal es incorrecta. En el caso de zerocopy, se pierden datos y el skb lineal es anexado con memoria del kernel no inicializada.\n\nDe todos los 3 transportes basados en virtio soportados, solo el transporte loopback se ve afectado. La cola rx del transporte virtio G2H opera con skbs explícitamente lineales; ver virtio_vsock_alloc_linear_skb() en virtio_vsock_rx_fill(). El transporte vhost H2G puede asignar skbs no lineales, pero solo para tamaños que no se consideran para la coalescencia; ver PAGE_ALLOC_COSTLY_ORDER en virtio_vsock_alloc_skb().\n\nAsegurar que solo los skbs lineales sean coalescidos. Tenga en cuenta que skb_tailroom(last_skb) > 0 garantiza que last_skb es lineal."
}
],
"lastModified": "2026-06-17T10:20:47.133",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}