PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46207 Linux CVE debrief

A vulnerability in the Linux kernel's virtio-vsock transport layer could cause uninitialized data to be delivered to the vsockmon monitoring interface when handling non-linear socket buffers (skbs). The issue stems from virtio_transport_build_skb() failing to properly initialize iov_iter.count when copying payload data for non-linear buffers, resulting in zero bytes copied and leaving monitor tap data uninitialized. The fix consolidates linear and non-linear handling paths using skb_copy_datagram_iter() with iov_iter_kvec(), matching the approach already used by vhost-vsock. This vulnerability affects kernel-based virtual machine (KVM) environments utilizing virtio-vsock for host-guest communication. The fix has been applied to multiple stable kernel branches.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Organizations running Linux-based virtualization infrastructure using KVM with virtio-vsock enabled, particularly those utilizing the vsockmon monitoring interface for debugging or security monitoring of host-guest socket communications.

Technical summary

The virtio_transport_build_skb() function in the Linux kernel's virtio-vsock transport incorrectly handles non-linear skbs when building packets for the vsockmon tap device. The function uses virtio_transport_copy_nonlinear_skb() which initializes an iov_iter without setting iov_iter.count, leaving it at zero due to zero-initialization. This causes no payload data to be copied to the monitor skb, resulting in uninitialized memory being exposed to the monitoring interface. The vulnerability is resolved by removing the separate linear/non-linear code paths and using skb_copy_datagram_iter() with iov_iter_kvec() for all cases, which properly initializes the iterator and handles both buffer types correctly. The fix also adds proper error checking for skb_copy_datagram_iter() return values.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution that include the fix for CVE-2026-46207
  • Verify virtio-vsock kernel module version matches patched releases in stable branches
  • Monitor vsockmon tap interface output for anomalies if running unpatched kernels with virtio-vsock enabled
  • Review KVM/virtualization host configurations for virtio-vsock usage
  • Schedule maintenance windows for kernel updates on affected virtualization infrastructure

Evidence notes

Vulnerability description confirms uninitialized data exposure in vsockmon tap device for non-linear skbs. Fix commit references indicate backports to stable kernel branches. No CVSS score or severity assigned by NVD at time of disclosure.

Official resources

2026-05-28