CVE-2026-46234

A flaw was found in the Linux kernel's vsock component. This vulnerability stems from an incorrect order in which buffer sizes are validated, allowing a local user to set a minimum buffer size larger than the maximum. This can cause the socket's memory to exceed its defined boundaries, potentially leading to resource exhaustion or system instability, which could result in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because exploiting it requires an unprivileged local user to interact with the virtual socket subsystem, and the resulting impact is confined to system resource exhaustion and denial of service. The logic flaw allows socket buffer allocations to bypass upper limits, enabling an attacker to trigger excessive kernel memory consumption. Confidentiality and data integrity are not compromised, and remote exploitation is not possible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.