CVE-2026-23057: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Coalesce only linear skb vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOOD_COPY_LEN = 128), an attempt is made to join them. Since the introduction of MSG_ZEROCOPY support, assumption that a small skb will always be linear is incorrect. In the zerocopy case, data is lost and the linear skb is appended with uninitialized kernel memory. Of all 3 supported virtio-based transports, only loopback-transport is affected. G2H virtio-transport rx queue operates on explicitly linear skbs; see virtio_vsock_alloc_linear_skb() in virtio_vsock_rx_fill(). H2G vhost-transport may allocate non-linear skbs, but only for sizes that are not considered for coalescence; see PAGE_ALLOC_COSTLY_ORDER in virtio_vsock_alloc_skb(). Ensure only linear skbs are coalesced. Note that skb_tailroom(last_skb) > 0 guarantees last_skb is linear.

Засегнати продукти

• Linux Linux: 581512a6dc939ef122e49336626ae159f3b8a345 преди 568e9cd8ed7ca9bf748c7687ba6501f29d30e59f; 581512a6dc939ef122e49336626ae159f3b8a345 преди 63ef9b300bd09e24c57050c5dbe68feedce42e72; 581512a6dc939ef122e49336626ae159f3b8a345 преди 0386bd321d0f95d041a7b3d7b07643411b044a96
• Linux Linux: 6.7; преди 6.7; 6.12.68 до 6.12.*; 6.18.8 до 6.18.*; от 6.19 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99268
• CVE-2026-99266
• CVE-2026-99267

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-23057
• https://nvd.nist.gov/vuln/detail/CVE-2026-23057
• https://git.kernel.org/stable/c/568e9cd8ed7ca9bf748c7687ba6501f29d30e59f
• https://git.kernel.org/stable/c/63ef9b300bd09e24c57050c5dbe68feedce42e72
• https://git.kernel.org/stable/c/0386bd321d0f95d041a7b3d7b07643411b044a96