PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46234 Linux CVE debrief

A logic error in the Linux kernel's vsock (virtual socket) subsystem allows buffer size constraints to be bypassed when a user-configured minimum exceeds the configured maximum. The vulnerability exists in `vsock_update_buffer_size()`, where clamping operations were performed in incorrect order—maximum bound applied first, then minimum bound. When `buffer_min_size > buffer_max_size`, the second check overrides the first, permitting `vsk->buffer_size` to exceed `vsk->buffer_max_size`. This breaks intended socket memory boundaries and could lead to excessive memory consumption in vsock-based communications, commonly used for host-guest VM interactions. The fix reorders the clamping operations to enforce minimum first, then maximum, ensuring the buffer size never exceeds the configured maximum regardless of minimum value. Multiple stable kernel branches received patches. No CVSS score has been assigned; CISA KEV has not listed this vulnerability.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

Organizations running Linux kernels with vsock enabled, particularly virtualization platforms using vsock for host-guest communication; cloud providers and enterprises with custom kernel buffer size configurations

Technical summary

The vsock subsystem in the Linux kernel contains a logic flaw in `vsock_update_buffer_size()` where buffer size clamping operations are performed in incorrect order. The function applies the maximum bound before the minimum bound, allowing a user-configured minimum buffer size larger than the maximum to override the maximum constraint. This results in `vsk->buffer_size` potentially exceeding `vsk->buffer_max_size`, breaking intended memory boundaries for virtual socket communications. The vulnerability affects systems using vsock for VM host-guest communication where non-default buffer size limits have been configured. The fix reorders clamping to enforce minimum first, then maximum, ensuring proper constraint satisfaction.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version and apply stable kernel patches from official Linux kernel git repositories when available for your distribution
  • Audit vsock socket configurations for systems where `buffer_min_size` has been explicitly set higher than `buffer_max_size`
  • Monitor memory usage on systems utilizing vsock for host-guest VM communication
  • Verify distribution-specific security advisories for backported fixes if running long-term support kernel versions

Evidence notes

Vulnerability description and fix details sourced from official CVE record and NVD entry published 2026-05-28. Patch commits identified in source references across multiple stable kernel branches. Vendor identification marked low confidence due to 'Unknown Vendor' classification in source data; Linux kernel is the affected product.

Official resources

2026-05-28