CVE-2026-23069

The crash originates from unsigned arithmetic in the function virtio_transport_get_credit within the Linux kernel’s virtio vsock subsystem. The calculation uses the peer’s advertised buffer size and subtracts the number of queued bytes, which can underflow if the peer reduces its buffer while bytes are still in flight. The resulting large positive value allows more data to be queued than the peer can safely handle, potentially overflowing the peer’s buffer and leading to memory corruption or a denial of service.

All Linux kernel implementations that expose the virtio vsock interface are affected, including the 6.19 release candidates referenced in the reported CPEs. Any distribution that ships the default virtio vsock driver with the vulnerable implementation is at risk.

The CVSS score of 5.5 denotes medium severity, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not present in the CISA KeV catalog. Exploitation would require an attacker able to influence the virtio communication path—typically a guest or host with access to the virtualization environment—making it a local or privileged scenario rather than a remote code execution attack.