Linux Kernel CVE-2026-52994

AF_VSOCK is a Linux address family providing socket-based communication between virtual machines and their hypervisors, with the virtio transport (virtio-vsock kernel module) being the primary backend. MSG_ZEROCOPY is a Linux send flag that bypasses kernel-buffer copying by pinning userspace pages directly for DMA; page pinning is accounted against RLIMIT_MEMLOCK to prevent privilege escalation through excessive memory locking. The flaw resides in virtio_transport_init_zcopy_skb(), which calls msg_zerocopy_realloc() with iter->count as the size argument. Because virtio_transport_fill_skb() invokes __zerocopy_sg_from_iter() before this accounting call, the iterator is fully consumed by the time the last skb is initialized, leaving iter->count at zero. Passing zero to mm_account_pinned_pages() causes the kernel to record no usage for the final - and often the largest - segment of a zerocopy send, silently underreporting pinned memory against RLIMIT_MEMLOCK. The correct approach, already used by TCP and UDP, is to pass the pre-computed pkt_len to msg_zerocopy_realloc() rather than relying on the live iterator. Affected CPE: cpe:2.3:a:linux:linux starting from commit 581512a6dc939ef122e49336626ae159f3b8a345, introduced around kernel 6.7. No CWE has been formally assigned, but this is a classic resource-accounting logic error (analogous to CWE-772 or CWE-400).