CVE-2026-52994

A flaw was found in the Linux kernel's vsock/virtio component. This vulnerability involves an accounting error in the MSG_ZEROCOPY pinned-pages mechanism, where the system's resource limit for locked memory (RLIMIT_MEMLOCK) may not be properly enforced. This could allow a local attacker or a malicious virtual machine guest to bypass memory locking restrictions, potentially leading to resource exhaustion or a denial of service (DoS) condition.

This vulnerability is assessed as Moderate impact because exploitation requires local access with the ability to initiate virtio VSOCK traffic, restricting the blast radius to memory exhaustion. In standard Red Hat Enterprise Linux deployments, an unprivileged user or virtualized guest can circumvent locked memory constraints due to omitted page accounting during zero-copy socket transfers. Because the condition cannot be leveraged for code execution or unauthorized data disclosure, the risk is limited to service degradation or denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.