CVE-2026-23057

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: Coalesce only linear skb

vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb

(with a spare tail room) is followed by a small skb (length limited by

GOOD_COPY_LEN = 128), an attempt is made to join them.

Since the introduction of MSG_ZEROCOPY support, assumption that a small skb

will always be linear is incorrect. In the zerocopy case, data is lost and

the linear skb is appended with uninitialized kernel memory.

Of all 3 supported virtio-based transports, only loopback-transport is

affected. G2H virtio-transport rx queue operates on explicitly linear skbs;

see virtio_vsock_alloc_linear_skb() in virtio_vsock_rx_fill(). H2G

vhost-transport may allocate non-linear skbs, but only for sizes that are

not considered for coalescence; see PAGE_ALLOC_COSTLY_ORDER in

virtio_vsock_alloc_skb().

Ensure only linear skbs are coalesced. Note that skb_tailroom(last_skb) > 0

guarantees last_skb is

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References