🛡️ CVE-2026-23057 — kernel

vsock/virtio: Coalesce only linear skb

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: Coalesce only linear skb

vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb

(with a spare tail room) is followed by a small skb (length limited by

GOOD_COPY_LEN = 128), an attempt is made to join them.

Since the introduction of MSG_ZEROCOPY support, assumption that a small skb

will always be linear is incorrect. In the zerocopy case, data is lost and

the linear skb is appended with uninitialized kernel memory.

Of all 3 supported virtio-based transports, only loopback-transport is

affected. G2H virtio-transport rx queue operates on explicitly linear skbs;

see virtio_vsock_alloc_linear_skb() in virtio_vsock_rx_fill(). H2G

vhost-transport may allocate non-linear skbs, but only for sizes that are

not considered for coalescence; see PAGE_ALLOC_COSTLY_ORDER in

virtio_vsock_alloc_skb().

Ensure only linear skbs are coalesced. Note that skb_tailroom(last_skb) > 0

guarantees last_skb is linear.