CVE-2026-23057

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: Coalesce only linear skb

vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOOD_COPY_LEN = 128), an attempt is made to join them.

Since the introduction of MSG_ZEROCOPY support, assumption that a small skb will always be linear is incorrect. In the zerocopy case, data is lost and the linear skb is appended with uninitialized kernel memory.

Of all 3 supported virtio-based transports, only loopback-transport is affected. G2H virtio-transport rx queue operates on explicitly linear skbs; see virtio_vsock_alloc_linear_skb() in virtio_vsock_rx_fill(). H2G vhost-transport may allocate non-linear skbs, but only for sizes that are not considered for coalescence; see PAGE_ALLOC_COSTLY_ORDER in virtio_vsock_alloc_skb().

Ensure only linear skbs are coalesced. Note that skb_tailroom(last_skb) > 0 guarantees last_skb is linear.

A kernel information leak can occur in the vsock virtio common receive path when small packets are coalesced into the last skb in the RX queue. The coalescing logic assumed that a small skb is always linear. After MSG_ZEROCOPY support, a small skb can be non linear and carry its payload in skb_shinfo fragments. In that case, copying from the skb linear area can append uninitialized kernel memory to the accumulated skb. This can expose kernel memory contents to userspace through the vsock socket receive API. For the CVSS the PR is typically L because an attacker needs local access to create vsock connections and use MSG_ZEROCOPY on the affected transport path. The issue is not generally network reachable. Impact is information disclosure. It may aid exploitation by leaking pointers or other sensitive data but it is not a direct privilege escalation by itself.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.