In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: fix potential unbounded skb queue

virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc.

virtio_transport_recv_enqueue() skips coalescing for packets
with VIRTIO_VSOCK_SEQ_EOM.

If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM,
a very large number of packets can be queued
because vvs->rx_bytes stays at 0.

Fix this by estimating the skb metadata size:

(Number of skbs in the queue) * SKB_TRUESIZE(0)

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
077706165717686a2a6a71405fef036cd5b37ae0 affected < 1eca304f97a34ed5e921e1f0e06c8b241f25bf12
077706165717686a2a6a71405fef036cd5b37ae0 affected < 9bdc637fde66b63d6cad0caacd034888bb7bf5f5
077706165717686a2a6a71405fef036cd5b37ae0 affected < 100d5b2ffdc6468b9e48532641f29e83efdcb63c
077706165717686a2a6a71405fef036cd5b37ae0 affected < 059b7dbd20a6f0c539a45ddff1573cb8946685b5
5852a2b573f7a3a29df46296e56aa3491e589cdf affected —
6.1.63 affected < 6.2
Linux Linux affected
Version Status Constraints
6.3 affected —
0 unaffected < 6.3
6.12.94 unaffected ≤ 6.12.*
6.18.36 unaffected ≤ 6.18.*
7.0.13 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/059b7dbd20a6f0c539a45ddff1573cb8946685b5 cve-icon
https://git.kernel.org/stable/c/100d5b2ffdc6468b9e48532641f29e83efdcb63c cve-icon
https://git.kernel.org/stable/c/1eca304f97a34ed5e921e1f0e06c8b241f25bf12 cve-icon
https://git.kernel.org/stable/c/9bdc637fde66b63d6cad0caacd034888bb7bf5f5 cve-icon
History

Thu, 25 Jun 2026 10:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-399

Thu, 25 Jun 2026 09:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential unbounded skb queue virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. virtio_transport_recv_enqueue() skips coalescing for packets with VIRTIO_VSOCK_SEQ_EOM. If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, a very large number of packets can be queued because vvs->rx_bytes stays at 0. Fix this by estimating the skb metadata size: (Number of skbs in the queue) * SKB_TRUESIZE(0)
Title vsock/virtio: fix potential unbounded skb queue
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-06-25T08:38:21.575Z

Reserved: 2026-06-09T07:44:35.386Z

Link: CVE-2026-53132

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-25T13:45:02Z

Weaknesses