PT-2026-61287 · Linux · Linux

CVE-2026-63970 · Publicado 2026-07-19 · Atualizado 2026-07-19

NVD

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: bind uarg before filling zerocopy skb

virtio transport send pkt info() allocates or reuses the zerocopy uarg before entering the send loop, but virtio transport alloc skb() still fills the skb before it inherits that uarg. When fixed-buffer vectored zerocopy hits MAX SKB FRAGS, io sg from iter() may partially attach managed frags and return -EMSGSIZE. The rollback path call kfree skb() to free an skb that carries SKBFL MANAGED FRAG REFS but no uarg, so skb release data() falls through to ordinary frag unref.

Pass the uarg into virtio transport alloc skb() and bind it immediately before virtio transport fill skb(). This keeps control or no-payload skbs untouched while ensuring success and rollback share one lifetime rule.

Correção

Identificadores relacionados

CVE-2026-63970

Produtos afetados

Linux

Referências · 4

• https://git.kernel.org/stable/c/5d317573f1d48e76cce5fb6250452b6e4102e0fb · Nota
• https://git.kernel.org/stable/c/b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d · Nota
• https://git.kernel.org/stable/c/1e584c304cfb94a759417130b1fc6d30b30c4cce · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63970 · Nota de Segurança