CVE-2026-46207

A flaw was found in the Linux kernel's vsock/virtio component. When processing non-linear data buffers for the vsockmon tap device, the system did not correctly initialize the payload. This oversight could lead to uninitialized data being copied to the monitoring interface, potentially resulting in inaccurate data transmission or unintended information exposure.

This vulnerability is rated as Moderate severity because exploitation requires local access with privileges to interact with VirtIO VSOCK interfaces, confining the blast radius to a localized denial of service or potential exposure of uninitialized memory rather than remote code execution. The condition is specifically triggered when handling non-linear socket buffers while traffic tapping via the vsockmon device is active. In typical Red Hat Enterprise Linux environments, VirtIO VSOCK is utilized inside virtualized guests or container runtimes, and packet capturing on VSOCK tap devices is generally restricted to privileged administrative troubleshooting.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.