Skip to main content

Linux Kernel EUVDEUVD-2026-39337

| CVE-2026-53132 HIGH
Memory Leak (CWE-401)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-g7xf-gg8w-vw6h
Information Disclosure Linux Red Hat Suse
7.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
vuln.today AI
7.1 HIGH

Local vsock access with no extra privileges (PR:N) and low complexity (AC:L) lets a guest exhaust host memory (S:C, A:H); no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:14 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.1 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: fix potential unbounded skb queue

virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc.

virtio_transport_recv_enqueue() skips coalescing for packets with VIRTIO_VSOCK_SEQ_EOM.

If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, a very large number of packets can be queued because vvs->rx_bytes stays at 0.

Fix this by estimating the skb metadata size:

(Number of skbs in the queue) * SKB_TRUESIZE(0)

AnalysisAI

Denial of service in the Linux kernel's virtio vsock transport allows a local actor to exhaust kernel memory by flooding the socket with zero-length packets flagged VIRTIO_VSOCK_SEQ_EOM, which bypass receive-buffer accounting and grow the skb receive queue without bound. The flaw affects the vsock/virtio guest-host communication path and carries CVSS 7.1 (A:H, scope-changed); EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis. Note a data conflict: the input tags it 'Information Disclosure', but the CVSS vector (C:N/I:N/A:H) and the description describe a memory-exhaustion availability issue, not disclosure.

Technical ContextAI

The vulnerability lives in the virtio vsock transport (virtio_transport_inc_rx_pkt / virtio_transport_recv_enqueue), the AF_VSOCK datagram/stream channel used for communication between virtual machines and their host (and in nested/container scenarios). The root cause is a flawed receive-buffer accounting invariant: virtio_transport_inc_rx_pkt() gates queuing on vvs->rx_bytes + len > vvs->buf_alloc, while virtio_transport_recv_enqueue() deliberately skips coalescing for packets carrying VIRTIO_VSOCK_SEQ_EOM. A stream of zero-length (len == 0) EOM-flagged packets therefore never advances rx_bytes, so the buf_alloc ceiling is never reached and an effectively unlimited number of skbs accumulate. This is a classic CWE-770 (Allocation of Resources Without Limits or Throttling) / CWE-400 (Uncontrolled Resource Consumption) pattern, even though the input lists CWE as N/A. The fix charges per-skb metadata overhead - (number of skbs) * SKB_TRUESIZE(0) - against the accounting so empty packets still count toward the limit.

RemediationAI

Apply the vendor-released kernel patch by upgrading to a fixed stable release - Vendor-released patch: 6.12.94, 6.18.36, or 7.0.13 (or your distribution's backported equivalent), corresponding to kernel.org stable commits 059b7dbd, 100d5b2f, 1eca304f, and 9bdc637f. Track your distro's security advisory and update to the kernel package that incorporates these commits. Where immediate patching is not possible, the practical compensating control is to limit who can open AF_VSOCK sockets and to constrain untrusted guests: in environments that do not require guest-host vsock, disable or unload the virtio vsock module (e.g., remove vhost_vsock / vmw_vsock_virtio_transport) to remove the attack surface entirely - the trade-off is that any service relying on vsock (some agent/guest-tooling channels) will stop working. For multi-tenant hosts that must keep vsock, restrict it to trusted guests and monitor host kernel memory for abnormal growth as a detective control. Reference the kernel.org commits above and https://nvd.nist.gov/vuln/detail/CVE-2026-53132 for confirmation of fixed versions.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-39337 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy