CVE-2026-53365

The Linux kernel’s virtio versus socket zero-copy implementation incorrectly handles pinned user pages when a large message is divided across multiple network buffer fragments. Only the final fragment is linked to the zerocopy state object, which tracks when the kernel can safely release the pages back to the user space. Intermediate fragments receive no completion notification, and if the send loop aborts early the zerocopy state object is never created, leading to a silent leak of pinned pages. The leaked pages consume kernel memory and can grow unchecked, potentially exhausting memory resources and degrading system performance. The vulnerability does not allow code execution or direct privilege escalation; its primary impact is a denial of service through memory exhaustion.

All Linux kernel systems that include the virtio “vsock” driver prior to the application of the patch are affected. The flaw resides in core kernel code, so the impact spans all distributions and kernel versions that lack the commit series referenced in the advisory. Kernel releases before the inclusion of the commit timestamped 2026-07-12 (76b995bc57bd) are vulnerable.

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to force the kernel to process large messages fragmented across multiple fragments repeatedly to deplete kernel memory. Without such conditions, the risk remains low. No publicly available exploits have been reported, but the threat of a memory exhaustion denial of service exists for systems that handle large versusocket traffic.