CVE-2026-23086

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: cap TX credit to local buffer size

The virtio transports derives its TX credit directly from peer_buf_alloc,

which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value.

On the host side this means that the amount of data we are willing to

queue for a connection is scaled by a guest-chosen buffer size, rather

than the host's own vsock configuration. A malicious guest can advertise

a large buffer and read slowly, causing the host to allocate a

correspondingly large amount of sk_buff memory.

The same thing would happen in the guest with a malicious host, since

virtio transports share the same code base.

Introduce a small helper, virtio_transport_tx_buf_size(), that

returns min(peer_buf_alloc, buf_alloc), and use it wherever we consume

peer_buf_alloc.

This ensures the effective TX window is bounded by both the peer's

advertised buffer and our own buf_alloc (already clamped to

buffer_max_size

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References