PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46234 Linux CVE debrief

A logic error in the Linux kernel's vsock (virtual socket) subsystem allows buffer size constraints to be bypassed when a user-configured minimum exceeds the configured maximum. The vulnerability exists in `vsock_update_buffer_size()`, where clamping operations were performed in incorrect order—maximum bound applied first, then minimum bound. When `buffer_min_size > buffer_max_size`, the second check overrides the first, permitting `vsk->buffer_size` to exceed `vsk->buffer_max_size`. This breaks intended socket memory boundaries and could lead to excessive memory consumption in vsock-based communications, commonly used for host-guest VM interactions. The fix reorders the clamping operations to enforce minimum first, then maximum, ensuring the buffer size never exceeds the configured maximum regardless of minimum value. Multiple stable kernel branches received patches. No CVSS score has been assigned; CISA KEV has not listed this vulnerability.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

Organizations running Linux kernels with vsock enabled, particularly virtualization platforms using vsock for host-guest communication; cloud providers and enterprises with custom kernel buffer size configurations

Technical summary

The vsock subsystem in the Linux kernel contains a logic flaw in `vsock_update_buffer_size()` where buffer size clamping operations are performed in incorrect order. The function applies the maximum bound before the minimum bound, allowing a user-configured minimum buffer size larger than the maximum to override the maximum constraint. This results in `vsk->buffer_size` potentially exceeding `vsk->buffer_max_size`, breaking intended memory boundaries for virtual socket communications. The vulnerability affects systems using vsock for VM host-guest communication where non-default buffer size limits have been configured. The fix reorders clamping to enforce minimum first, then maximum, ensuring proper constraint satisfaction.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version and apply stable kernel patches from official Linux kernel git repositories when available for your distribution
  • Audit vsock socket configurations for systems where `buffer_min_size` has been explicitly set higher than `buffer_max_size`
  • Monitor memory usage on systems utilizing vsock for host-guest VM communication
  • Verify distribution-specific security advisories for backported fixes if running long-term support kernel versions

Evidence notes

Vulnerability description and fix details sourced from official CVE record and NVD entry published 2026-05-28. Patch commits identified in source references across multiple stable kernel branches. Vendor identification marked low confidence due to 'Unknown Vendor' classification in source data; Linux kernel is the affected product.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46234 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46234

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46234 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46234

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0b68881501460c3761f196469e1e503218c5e536

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2602f7bb5818e92315feeaeb71d8ce4d5c9ab160

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/310da27932dd0afe7ce7456dfe1f0814c3301f41

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a998a7e250bf976539e05a00ec64a81292afecaa

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d114bfdc9b76bf93b881e195b7ec957c14227bab

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.