The Linux kernel's vsock/virtio subsystem was found to incorrectly merge small receive buffers under certain zero‑copy conditions, which can cause a linear socket buffer to be appended with uninitialized kernel memory, leading to data loss and potential corruption of kernel memory and compromising the integrity of data processed by the vsock transport.

The flaw affects the loopback‑based vsock/virtio transport in Linux kernel implementations; it does not impact the g2h transport, which always allocates linear buffers, nor the h2g vhost channel, which avoids small non‑linear buffers. Because specific kernel version information is not provided, users should verify that their current kernel includes the fix that introduces safe handling of skb coalescence.

The vulnerability carries a CVSS score of 7.0 and an EPSS exploitation probability of less than 1 %, and it has not been listed in the CISA Known Exploited Vulnerabilities catalog. The attack surface resides in kernel space, requiring interaction with the vsock/virtio loopback interface; although rare, an attacker could trigger repeated mis‑coalescence to corrupt kernel memory, potentially enabling privilege escalation or system crash.