Linux Kernel EUVD-2026-39337

Exploitation requires local access to an AF_VSOCK endpoint with the virtio vsock transport enabled (CONFIG_VSOCKETS plus virtio/vhost vsock loaded) - typically code running inside a guest VM communicating with its host, or a local process on a system using virtio vsock. The specific trigger condition is the attacker's ability to send vsock packets with len == 0 carrying the VIRTIO_VSOCK_SEQ_EOM flag, which exploit the coalescing-skip path. Limiting factors: the attack vector is local (AV:L), not remote-over-IP; vsock must actually be in use/enabled (non-default for many bare-metal deployments but common in virtualization and guest-agent setups); and impact is confined to availability (memory/DoS), with no path to data disclosure or code execution. The scope change means a guest can affect the host, which is the primary reason this matters in multi-tenant environments.

Signals are mostly consistent and point to a real but bounded, locally-triggered availability risk rather than a widely-exploited emergency. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, 7.1) indicates low-complexity local triggering with no privileges and a scope change (a guest can exhaust host kernel memory), but the only impact is availability - no confidentiality or integrity loss. EPSS is very low (0.17%, percentile 6), the CVE is not on CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis. The scope-changed availability impact is the main aggravator: a malicious or compromised guest VM could potentially degrade or crash the host, making this relevant in multi-tenant virtualization. Conflicts to flag: (1) the 'Information Disclosure' tag contradicts the C:N/I:N/A:H vector - treat this as DoS, not disclosure; (2) PR:N implies no authentication, but exploitation in practice still requires the ability to send vsock packets (i.e., local code execution in a guest/host context), so 'unauthenticated' should be read as 'no additional privileges beyond local vsock access.'

A tenant with code execution inside a guest VM opens an AF_VSOCK connection to the host and transmits a rapid stream of zero-length packets each flagged VIRTIO_VSOCK_SEQ_EOM. Because these packets never increment rx_bytes, the host kernel queues them without limit, steadily consuming kernel memory until the host degrades or triggers OOM conditions. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) makes a proof-of-concept straightforward to write.