CVE-2026-63970

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vsock/virtio: bind uarg before filling zerocopy skb<br /> <br /> virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg<br /> before entering the send loop, but virtio_transport_alloc_skb() still<br /> fills the skb before it inherits that uarg. When fixed-buffer vectored<br /> zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach<br /> managed frags and return -EMSGSIZE. The rollback path call kfree_skb()<br /> to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so<br /> skb_release_data() falls through to ordinary frag unref.<br /> <br /> Pass the uarg into virtio_transport_alloc_skb() and bind it immediately<br /> before virtio_transport_fill_skb(). This keeps control or no-payload skbs<br /> untouched while ensuring success and rollback share one lifetime rule.