The Linux kernel’s vsock/virtio zero‑copy implementation incorrectly manages pinned user pages when a large message is split across multiple skbs. Only the final skb is associated with the zerocopy uarg, leaving intermediate skbs without completion tracking. The kernel therefore has no mechanism to inform user space when the pages can be safely reused, resulting in a leak of pinned pages that remains unknown to the application. If the loop exits prematurely the uarg is never created, causing a silent leak of pinned memory. This resource exhaustion can degrade kernel performance or lead to a denial of service.

All systems running a Linux kernel that includes the virtio vsock driver before the fix are affected. The vulnerability applies to the Linux kernel chain regardless of distribution, as the issue is in the core kernel code rather than a specific distribution patch. The specific affected releases are those that do not contain the commit series referenced in the description (for example, kernel versions prior to the inclusion of commit 76b995bc57bd).

The CVSS score is 5.5 and the EPSS score is less than 1%, indicating a low probability of exploitation in current conditions; the vulnerability is not listed in CISA KEV. The absence of a completion notification means that any program that performs large, vsock can leave pinned pages permanently allocated. Based on the description, it is inferred that an attacker who can generate many such messages could intentionally deplete memory resources, leading to a denial of service. No public exploits are known, but the risk is elevated because privileged applications or misconfigurations can trigger the leak.