CVE-2026-23057
- Source
- https://cve.org/CVERecord?id=CVE-2026-23057
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23057.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-23057
- Downstream
- Published
- 2026-02-04T16:07:40.550Z
- Modified
- 2026-02-09T19:34:38.572653Z
- Summary
- vsock/virtio: Coalesce only linear skb
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: Coalesce only linear skb
vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOODCOPYLEN = 128), an attempt is made to join them.
Since the introduction of MSG_ZEROCOPY support, assumption that a small skb will always be linear is incorrect. In the zerocopy case, data is lost and the linear skb is appended with uninitialized kernel memory.
Of all 3 supported virtio-based transports, only loopback-transport is affected. G2H virtio-transport rx queue operates on explicitly linear skbs; see virtiovsockalloclinearskb() in virtiovsockrxfill(). H2G vhost-transport may allocate non-linear skbs, but only for sizes that are not considered for coalescence; see PAGEALLOCCOSTLYORDER in virtiovsockalloc_skb().
Ensure only linear skbs are coalesced. Note that skbtailroom(lastskb) > 0 guarantees last_skb is linear.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23057.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/0386bd321d0f95d041a7b3d7b07643411b044a96
- https://git.kernel.org/stable/c/568e9cd8ed7ca9bf748c7687ba6501f29d30e59f
- https://git.kernel.org/stable/c/63ef9b300bd09e24c57050c5dbe68feedce42e72
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23057.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-23057
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced581512a6dc939ef122e49336626ae159f3b8a345Fixed568e9cd8ed7ca9bf748c7687ba6501f29d30e59fFixed63ef9b300bd09e24c57050c5dbe68feedce42e72Fixed0386bd321d0f95d041a7b3d7b07643411b044a96