{"id":"CVE-2026-46207","title":"vsock/virtio: fix empty payload in tap skb for non-linear buffers","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix empty payload in tap skb for non-linear buffers\n\nFor non-linear skbs, virtio_transport_build_skb() goes through\nvirtio_transport_copy_nonlinear_skb() …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4b0bf10eb077cb43c09746251ef3608d62c45667 < 06747f52ab157591cec7e5623a759473b66ef6f6","Linux >= 4b0bf10eb077cb43c09746251ef3608d62c45667 < 52da6a74ca3de0fcda60301096b71534b3b18641","Linux >= 4b0bf10eb077cb43c09746251ef3608d62c45667 < 378b131a25bd1a5ee27ca199fe486c299d5350c5","Linux >= 4b0bf10eb077cb43c09746251ef3608d62c45667 < 3a3e3d90cbc79600544536723911657730759af3","Linux 6.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:11:59.640569Z"},"published":"2026-05-28","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:13:44.671Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46207","references":[{"url":"https://git.kernel.org/stable/c/06747f52ab157591cec7e5623a759473b66ef6f6"},{"url":"https://git.kernel.org/stable/c/52da6a74ca3de0fcda60301096b71534b3b18641"},{"url":"https://git.kernel.org/stable/c/378b131a25bd1a5ee27ca199fe486c299d5350c5"},{"url":"https://git.kernel.org/stable/c/3a3e3d90cbc79600544536723911657730759af3"}],"tags":["cve.org"],"epss":0.00127,"epssPercentile":0.02428,"ingestedAt":"2026-11-06T16:57:43.324Z","slug":"CVE-2026-46207","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix empty payload in tap skb for non-linear buffers\n\nFor non-linear skbs, virtio_transport_build_skb() goes through\nvirtio_transport_copy_nonlinear_skb() to copy the original payload\nin the new skb to be delivered to the vsockmon tap device.\nThis manually initializes an iov_iter but does not set iov_iter.count.\nSince the iov_iter is zero-initialized, the copy length is zero and no\npayload is actually copied to the monitor interface, leaving data\nun-initialized.\n\nFix this by removing the linear vs non-linear split and using\nskb_copy_datagram_iter() with iov_iter_kvec() for all cases, as\nvhost-vsock already does. This handles both linear and non-linear skbs,\nproperly initializes the iov_iter, and removes the now unused\nvirtio_transport_copy_nonlinear_skb().\n\nWhile touching this code, let's also check the return value of\nskb_copy_datagram_iter(), even though it's unlikely to fail.\n\n## Affected\n\n- `Linux >= 4b0bf10eb077cb43c09746251ef3608d62c45667 < 06747f52ab157591cec7e5623a759473b66ef6f6`\n- `Linux >= 4b0bf10eb077cb43c09746251ef3608d62c45667 < 52da6a74ca3de0fcda60301096b71534b3b18641`\n- `Linux >= 4b0bf10eb077cb43c09746251ef3608d62c45667 < 378b131a25bd1a5ee27ca199fe486c299d5350c5`\n- `Linux >= 4b0bf10eb077cb43c09746251ef3608d62c45667 < 3a3e3d90cbc79600544536723911657730759af3`\n- `Linux 6.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}