CVE-2026-52994

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting<br /> <br /> virtio_transport_init_zcopy_skb() uses iter-&gt;count as the size argument<br /> for msg_zerocopy_realloc(), which in turn passes it to<br /> mm_account_pinned_pages() for RLIMIT_MEMLOCK accounting. However, this<br /> function is called after virtio_transport_fill_skb() has already consumed<br /> the iterator via __zerocopy_sg_from_iter(), so on the last skb, iter-&gt;count<br /> will be 0, skipping the RLIMIT_MEMLOCK enforcement.<br /> <br /> Pass pkt_len (the total bytes being sent) as an explicit parameter to<br /> virtio_transport_init_zcopy_skb() instead of reading the already-consumed<br /> iter-&gt;count.<br /> <br /> This matches TCP and UDP, which both call msg_zerocopy_realloc() with<br /> the original message size.