CVE-2026-53365

A flaw was found in the Linux kernel's vsock/virtio component. This vulnerability occurs during zerocopy completion for large messages fragmented into multiple socket kernel buffers (skbs). An issue in how user arguments (uargs) are handled for these buffers can lead to pinned user pages not being properly tracked or released. This prevents the kernel from notifying userspace when these memory pages are safe to reuse, potentially leading to memory leaks or data corruption if pages are prematurely reallocated. This issue could lead to local privilege escalation.

Red Hat Enterprise Linux 9.2 and earlier are not affected by this flaw. The vulnerable code was introduced by the upstream commit that added MSG_ZEROCOPY support to the virtio-vsock transport (581512a). This feature was not backported to RHEL 9.2 or earlier kernel versions, so the affected zerocopy transmit code path does not exist in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerable code path is only reachable when using virtio-vsock with zerocopy transmit on virtual machines using the vhost-vsock or virtio-vsock transport. Systems that do not use VM socket communication (AF_VSOCK) are not affected.

To prevent the vulnerable code path from being reached, the vhost_vsock kernel module can be unloaded and blacklisted if vsock functionality is not required:

modprobe -r vhost_vsock
echo "blacklist vhost_vsock" > /etc/modprobe.d/vsock-blacklist.conf

Systems that rely on VM-to-host socket communication (e.g., QEMU guest agent communication) cannot use this mitigation and should prioritize applying the kernel fix.