CVE-2026-53365
Description
A flaw was found in the Linux kernel's vsock/virtio component. This vulnerability occurs during zerocopy completion for large messages fragmented into multiple socket kernel buffers (skbs). An issue in how user arguments (uargs) are handled for these buffers can lead to pinned user pages not being properly tracked or released. This prevents the kernel from notifying userspace when these memory pages are safe to reuse, potentially leading to memory leaks or data corruption if pages are prematurely reallocated. This issue could lead to local privilege escalation.
Statement
Red Hat Enterprise Linux 9.2 and earlier are not affected by this flaw. The vulnerable code was introduced by the upstream commit that added MSG_ZEROCOPY support to the virtio-vsock transport (581512a). This feature was not backported to RHEL 9.2 or earlier kernel versions, so the affected zerocopy transmit code path does not exist in those kernels.
Mitigation
The vulnerable code path is only reachable when using virtio-vsock with zerocopy transmit on virtual machines using the vhost-vsock or virtio-vsock transport. Systems that do not use VM socket communication (AF_VSOCK) are not affected.
To prevent the vulnerable code path from being reached, the vhost_vsock kernel module can be unloaded and blacklisted if vsock functionality is not required:
modprobe -r vhost_vsockSystems that rely on VM-to-host socket communication (e.g., QEMU guest agent communication) cannot use this mitigation and should prioritize applying the kernel fix.
echo "blacklist vhost_vsock" > /etc/modprobe.d/vsock-blacklist.conf
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | 5.5 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | None | High |
| Integrity Impact | High | None | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
An adversary that can cause a resource counter to become inaccurate may be able to create situations where resources are not accounted for and not released, thus causing resources to become scarce for future needs.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An adversary that can cause a resource counter to become inaccurate may be able to force an error that causes the product to crash or exit out of its current operation.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
