Skip to main content

Linux Kernel CVE-2026-53365

MEDIUM
Memory Leak (CWE-401)
2026-07-13 Linux
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local low-privilege access required to open vsock and issue MSG_ZEROCOPY sends; only availability is impacted via cumulative memory leak with no confidentiality or integrity effects.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 22, 2026 - 20:06 vuln.today
CVSS changed
Jul 22, 2026 - 19:22 NVD
5.5 (MEDIUM)
CVE Published
Jul 13, 2026 - 17:33 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 13, 2026 - 17:33 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: fix zerocopy completion for multi-skb sends

When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. Non-final skbs carry pinned user pages with no completion tracking, so the kernel has no way to notify userspace when those pages are safe to reuse. If the loop breaks early the uarg is never allocated at all, leaking pinned pages with no completion notification.

Fix this by following the approach used by TCP: allocate the zerocopy uarg (if not provided by the caller) before the send loop and attach it to every skb via skb_zcopy_set(), which takes a reference per skb. Each skb's completion properly decrements the refcount, and the notification only fires after the last skb is freed. On failure, if no data was sent, the uarg is cleanly aborted via net_zcopy_put_abort().

This issue was initially discovered by sashiko while reviewing commit 1cb36e252211 ("vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting") but was pre-existing.

AnalysisAI

Pinned user-page leak in the Linux kernel vsock/virtio zerocopy send path allows a local low-privilege user to exhaust kernel memory and cause a denial of service. The flaw exists because the zerocopy completion tracking structure (uarg) is only allocated and attached to the final skb in a multi-skb send loop, leaving all earlier skbs with pinned user pages and no refcount management; an early loop break produces pinned pages with zero completion path. No active exploitation is confirmed (not in CISA KEV), EPSS probability sits at 0.15% (5th percentile), and upstream stable patches are available.

Technical ContextAI

The vsock/virtio subsystem provides virtual socket communication between guest VMs and the hypervisor over the virtio transport layer. When applications use MSG_ZEROCOPY for large sends, the kernel avoids copying data by pinning user-space pages and passing them directly through the I/O path. Fragmentation of large messages produces multiple socket buffers (skbs), each of which must carry a reference to the zerocopy user argument structure (uarg) so that per-skb completion callbacks can decrement a shared refcount and fire the userspace notification only after all skbs are freed - the same design TCP uses. The root cause (CWE-401: Missing Release of Memory after Effective Lifetime) is that the uarg was allocated inside the send loop and attached only to the last skb; prior skbs pinned pages with no tracking, and an early break left the uarg unallocated entirely. The fix pre-allocates the uarg before the loop and attaches it to every skb via skb_zcopy_set(), with net_zcopy_put_abort() cleaning up on failure when no data was sent. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Apply the upstream stable kernel patches at git.kernel.org/stable: commits 76b995bc57bd90cb6e954e1966fbd8786da47f0d, b3155f2b78db21e99256bcf7eb902f24ff6d5338, and ae38d9179190a956e2a87a69ef1dd6f451b51c4d cover multiple stable branches. Ubuntu users should update kernels per USN-8568-1 and USN-8566-1 at https://ubuntu.com/security/notices/USN-8568-1 and https://ubuntu.com/security/notices/USN-8566-1 respectively. As a compensating control pending patch deployment, applications using vsock/virtio should avoid passing MSG_ZEROCOPY for large sends, falling back to standard copy-based sends; this eliminates the vulnerable code path at the cost of reduced throughput in high-bandwidth VM communication scenarios. Alternatively, blocking unprivileged loading of the virtio-vsock kernel module (e.g., via modprobe deny lists) prevents the subsystem from being available to non-root users, though this disables vsock functionality entirely for those users.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-53365 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy