CVE-2026-23057

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vsock/virtio: Coalesce only linear skb<br /> <br /> vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb<br /> (with a spare tail room) is followed by a small skb (length limited by<br /> GOOD_COPY_LEN = 128), an attempt is made to join them.<br /> <br /> Since the introduction of MSG_ZEROCOPY support, assumption that a small skb<br /> will always be linear is incorrect. In the zerocopy case, data is lost and<br /> the linear skb is appended with uninitialized kernel memory.<br /> <br /> Of all 3 supported virtio-based transports, only loopback-transport is<br /> affected. G2H virtio-transport rx queue operates on explicitly linear skbs;<br /> see virtio_vsock_alloc_linear_skb() in virtio_vsock_rx_fill(). H2G<br /> vhost-transport may allocate non-linear skbs, but only for sizes that are<br /> not considered for coalescence; see PAGE_ALLOC_COSTLY_ORDER in<br /> virtio_vsock_alloc_skb().<br /> <br /> Ensure only linear skbs are coalesced. Note that skb_tailroom(last_skb) &gt; 0<br /> guarantees last_skb is linear.