PT-2026-61287 · Linux · Linux

CVE-2026-63970 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: bind uarg before filling zerocopy skb

virtio transport send pkt info() allocates or reuses the zerocopy uarg before entering the send loop, but virtio transport alloc skb() still fills the skb before it inherits that uarg. When fixed-buffer vectored zerocopy hits MAX SKB FRAGS, io sg from iter() may partially attach managed frags and return -EMSGSIZE. The rollback path call kfree skb() to free an skb that carries SKBFL MANAGED FRAG REFS but no uarg, so skb release data() falls through to ordinary frag unref.

Pass the uarg into virtio transport alloc skb() and bind it immediately before virtio transport fill skb(). This keeps control or no-payload skbs untouched while ensuring success and rollback share one lifetime rule.

Fix

Related Identifiers

CVE-2026-63970

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-63970 · Security Note
• https://git.kernel.org/stable/c/5d317573f1d48e76cce5fb6250452b6e4102e0fb · Note
• https://git.kernel.org/stable/c/b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d · Note
• https://git.kernel.org/stable/c/1e584c304cfb94a759417130b1fc6d30b30c4cce · Note