CVE-2026-63970 Details

A vulnerability in the Linux kernel's vsock/virtio implementation relates to improper handling of zero-copy user arguments in buffer management. The issue arises because the function that sends packet information allocates or reuses the zero-copy user argument before entering the sending loop. However, the function responsible for allocating the socket buffer still populates the buffer before it receives the user argument. This misalignment can lead to errors when the zero-copy feature, used with fixed-buffer vectored data, hits the maximum allowed fragments. In such cases, the system may partially attach managed fragments and return an error indicating that the message size is too large. The error handling process then attempts to free the buffer in a way that can inadvertently cause issues with fragment management. The vulnerability has been addressed by modifying the buffer allocation function to immediately bind the user argument before filling the buffer with data, ensuring that the management of buffer fragments is handled correctly and consistently.

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux kernel official website.