Linux Kernel CVE-2026-46207

The vulnerability resides in the Linux kernel's VirtIO VSock transport implementation (net/vmw_vsock/virtio_transport.c), which handles host-guest socket communication in virtualized environments using the VirtIO protocol. The function virtio_transport_build_skb() is responsible for constructing socket buffers (skbs) delivered to the vsockmon tap monitoring interface. Prior to the fix, this function bifurcated its logic: linear skbs were handled directly, while non-linear skbs (those with paged data fragments rather than contiguous memory) were routed through virtio_transport_copy_nonlinear_skb(). That non-linear path manually initialized an iov_iter structure but omitted setting iov_iter.count - leaving it at zero after zero-initialization. As a result, the copy operation transfers zero bytes and the monitor skb's data region contains uninitialized (potentially stale) kernel memory. The fix unifies both paths under skb_copy_datagram_iter() with iov_iter_kvec(), mirroring the approach already used by vhost-vsock. CWE-401 (Missing Release of Memory after Effective Lifetime) is assigned, though the more precise root cause is incomplete initialization of a kernel data structure (closer to CWE-909), not a classic memory leak; this classification may be imprecise.