CVE-2026-23086

vsock/virtio: cap TX credit to local buffer size

Published Feb 4, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: cap TX credit to local buffer size

The virtio transports derives its TX credit directly from peer_buf_alloc,
which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value.

On the host side this means that the amount of data we are willing to
queue for a connection is scaled by a guest-chosen buffer size, rather
than the host's own vsock configuration. A malicious guest can advertise
a large buffer and read slowly, causing the host to allocate a
correspondingly large amount of sk_buff memory.
The same thing would happen in the guest with a malicious host, since
virtio transports share the same code base.

Introduce a small helper, virtio_transport_tx_buf_size(), that
returns min(peer_buf_alloc, buf_alloc), and use it wherever we consume
peer_buf_alloc.

This ensures the effective TX window is bounded by both the peer's
advertised buffer and our own buf_alloc (already clamped to
buffer_max_size via SO_VM_SOCKETS_BUFFER_MAX_SIZE), so a remote peer
cannot force the other to queue more data than allowed by its own
vsock settings.

On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with
32 guest vsock connections advertising 2 GiB each and reading slowly
drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only
recovered after killing the QEMU process. That said, if QEMU memory is
limited with cgroups, the maximum memory used will be limited.

With this patch applied:

Before:
MemFree: ~61.6 GiB
Slab: ~142 MiB
SUnreclaim: ~117 MiB

After 32 high-credit connections:
MemFree: ~61.5 GiB
Slab: ~178 MiB
SUnreclaim: ~152 MiB

Only ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest
remains responsive.

Compatibility with non-virtio transports:

- VMCI uses the AF_VSOCK buffer knobs to size its queue pairs per
socket based on the local vsk->buffer_* values; the remote side
cannot enlarge those queues beyond what the local endpoint
configured.

- Hyper-V's vsock transport uses fixed-size VMBus ring buffers and
an MTU bound; there is no peer-controlled credit field comparable
to peer_buf_alloc, and the remote endpoint cannot drive in-flight
kernel memory above those ring sizes.

- The loopback path reuses virtio_transport_common.c, so it
naturally follows the same semantics as the virtio transport.

This change is limited to virtio_transport_common.c and thus affects
virtio-vsock, vhost-vsock, and loopback, bringing them in line with the
"remote window intersected with local policy" behaviour that VMCI and
Hyper-V already effectively have.

[Stefano: small adjustments after changing the previous patch]
[Stefano: tweak the commit message]

Analysis

Technical impact

The vulnerability in the Linux kernel’s virtio vsock transport lets a malicious peer advertise an arbitrarily large send buffer size. This forces the host or guest to reserve an equivalent amount of sk_buff memory, causing slab allocation to grow uncontrollably. An attacker can therefore exhaust kernel memory and trigger out‑of‑memory conditions or make the system unresponsive. The flaw is a classic case of uncontrolled resource consumption.

Affected Systems

All Linux kernel builds that include virtio vsock support, such as typical KVM/QEMU hosts and their guests, are affected by this issue in versions before the patch that caps the TX credit to the lower of the peer’s buffer and the local limit. Kernel releases that integrate the virtio_transport_tx_buf_size change, including 6.19 rc6 and later, have removed the flaw.

Risk and Exploitability

The CVSS base score of 5.5 indicates moderate severity, while an EPSS value of less than 1% points to a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires control over a virtual machine or host to open many vsock connections advertising large buffers; such activity can be detected and limited with cgroups or memory constraints. Successful exploitation can consume tens of gigabytes of memory, potentially leading to kernel OOM kills and downtime.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`06a8fc78367d070720af960dcecec917d3ae5f3b`	affected	< fef7110ae5617555c792a2bb4d27878d84583adf
`06a8fc78367d070720af960dcecec917d3ae5f3b`	affected	< d9d5f222558b42f6277eafaaa6080966faf37676
`06a8fc78367d070720af960dcecec917d3ae5f3b`	affected	< c0e42fb0e054c2b2ec4ee80f48ccd256ae0227ce
`06a8fc78367d070720af960dcecec917d3ae5f3b`	affected	< 84ef86aa7120449828d1e0ce438c499014839711
`06a8fc78367d070720af960dcecec917d3ae5f3b`	affected	< 8ee784fdf006cbe8739cfa093f54d326cbf54037

Linux

affected

Version	Status	Constraints
`4.8`	affected	—
`0`	unaffected	< 4.8
`6.1.162`	unaffected	≤ 6.1.*
`6.6.122`	unaffected	≤ 6.6.*
`6.12.68`	unaffected	≤ 6.12.*
`6.18.8`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc1::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc2::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that includes the virtio_transport_tx_buf_size patch (such as kernel 6.19 rc6 or later).
If an immediate kernel upgrade is not feasible, limit the maximum vsock buffer that a guest or host can advertise by configuring SO_VM_SOCKETS_BUFFER_MAX_SIZE or applying cgroup memory constraints to prevent excessive slab allocation.
Reduce the number of simultaneous virtio‑vsock connections or enforce per‑VM or per‑guest connection limits through hypervisor configuration to mitigate large‑buffer amplification.
Monitor slab allocation and memory usage metrics to detect abnormal growth patterns indicative of exploitation attempts.

Generated by OpenCVE AI on April 17, 2026 at 23:35 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4476-1	linux-6.1 security update
Debian DSA	DSA-6126-1	linux security update
Debian DSA	DSA-6127-1	linux security update
Ubuntu USN	USN-8278-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8289-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8296-1	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8296-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8278-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8440-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8570-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8594-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8604-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8605-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8570-2	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8289-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8393-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8669-1	Linux kernel (NVIDIA) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.171% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://git.kernel.org/stable/c/84ef86aa7120449828d1e0ce438c499014839711
https://git.kernel.org/stable/c/8ee784fdf006cbe8739cfa093f54d326cbf54037
https://git.kernel.org/stable/c/c0e42fb0e054c2b2ec4ee80f48ccd256ae0227ce
https://git.kernel.org/stable/c/d9d5f222558b42f6277eafaaa6080966faf37676
https://git.kernel.org/stable/c/fef7110ae5617555c792a2bb4d27878d84583adf
https://lore.kernel.org/linux-cve-announce/2026020423-CVE-2026-23086-9ad9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23086
https://www.cve.org/CVERecord?id=CVE-2026-23086

History

Oct 15, 2026 2:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-457936.html

Jun 11, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 18, 2026 12:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-400

Mar 17, 2026 9:15 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:6.19:rc1:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc2:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc3:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc4:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc5:::::: cpe:2.3:o:linux:linux_kernel:6.19:rc6::::::
Metrics	cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Feb 6, 2026 5:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/fef7110ae5617555c792a2bb4d27878d84583adf

Feb 5, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026020423-CVE-2026-23086-9ad9@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23086 https://www.cve.org/CVERecord?id=CVE-2026-23086
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Feb 4, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: cap TX credit to local buffer size The virtio transports derives its TX credit directly from peer_buf_alloc, which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value. On the host side this means that the amount of data we are willing to queue for a connection is scaled by a guest-chosen buffer size, rather than the host's own vsock configuration. A malicious guest can advertise a large buffer and read slowly, causing the host to allocate a correspondingly large amount of sk_buff memory. The same thing would happen in the guest with a malicious host, since virtio transports share the same code base. Introduce a small helper, virtio_transport_tx_buf_size(), that returns min(peer_buf_alloc, buf_alloc), and use it wherever we consume peer_buf_alloc. This ensures the effective TX window is bounded by both the peer's advertised buffer and our own buf_alloc (already clamped to buffer_max_size via SO_VM_SOCKETS_BUFFER_MAX_SIZE), so a remote peer cannot force the other to queue more data than allowed by its own vsock settings. On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with 32 guest vsock connections advertising 2 GiB each and reading slowly drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only recovered after killing the QEMU process. That said, if QEMU memory is limited with cgroups, the maximum memory used will be limited. With this patch applied: Before: MemFree: ~61.6 GiB Slab: ~142 MiB SUnreclaim: ~117 MiB After 32 high-credit connections: MemFree: ~61.5 GiB Slab: ~178 MiB SUnreclaim: ~152 MiB Only ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest remains responsive. Compatibility with non-virtio transports: - VMCI uses the AF_VSOCK buffer knobs to size its queue pairs per socket based on the local vsk->buffer_* values; the remote side cannot enlarge those queues beyond what the local endpoint configured. - Hyper-V's vsock transport uses fixed-size VMBus ring buffers and an MTU bound; there is no peer-controlled credit field comparable to peer_buf_alloc, and the remote endpoint cannot drive in-flight kernel memory above those ring sizes. - The loopback path reuses virtio_transport_common.c, so it naturally follows the same semantics as the virtio transport. This change is limited to virtio_transport_common.c and thus affects virtio-vsock, vhost-vsock, and loopback, bringing them in line with the "remote window intersected with local policy" behaviour that VMCI and Hyper-V already effectively have. [Stefano: small adjustments after changing the previous patch] [Stefano: tweak the commit message]
Title		vsock/virtio: cap TX credit to local buffer size
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/84ef86aa7120449828d1e0ce438c499014839711 https://git.kernel.org/stable/c/8ee784fdf006cbe8739cfa093f54d326cbf54037 https://git.kernel.org/stable/c/c0e42fb0e054c2b2ec4ee80f48ccd256ae0227ce https://git.kernel.org/stable/c/d9d5f222558b42f6277eafaaa6080966faf37676