{"id":"CVE-2026-63970","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: bind uarg before filling zerocopy skb\n\nvirtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg\nbefore entering the send loop, but virtio_tr…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: bind uarg before filling zerocopy skb\n\nvirtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg\nbefore entering the send loop, but virtio_tr…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416","CWE-825"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.7, < 6.12.97","linux_kernel >= 6.13, < 6.18.35","linux_kernel >= 6.19, < 7.0.12","linux_kernel = 7.1"],"patched":["linux_kernel 7.0.12"],"published":"2026-07-19","updated":"2026-10-02","sourceUpdated":"2026-10-02T19:38:05.180","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63970","references":[{"url":"https://git.kernel.org/stable/c/1e584c304cfb94a759417130b1fc6d30b30c4cce","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d317573f1d48e76cce5fb6250452b6e4102e0fb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72194f65050958e4c8e069adb6c5d89ef81ca197","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63970.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-63970"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502411"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63970"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63970"},{"url":"https://lore.kernel.org/linux-cve-announce/2026071959-CVE-2026-63970-1142@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:77690"},{"url":"https://access.redhat.com/errata/RHSA-2026:77689"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00176,"epssPercentile":0.07115,"ingestedAt":"2026-10-02T22:33:09.807Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:34:15.768672Z"},"scores":{"nvd":7.8,"vendor":7,"cna":7.8},"slug":"CVE-2026-63970","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: bind uarg before filling zerocopy skb\n\nvirtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg\nbefore entering the send loop, but virtio_transport_alloc_skb() still\nfills the skb before it inherits that uarg. When fixed-buffer vectored\nzerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach\nmanaged frags and return -EMSGSIZE. The rollback path call kfree_skb()\nto free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so\nskb_release_data() falls through to ordinary frag unref.\n\nPass the uarg into virtio_transport_alloc_skb() and bind it immediately\nbefore virtio_transport_fill_skb(). This keeps control or no-payload skbs\nuntouched while ensuring success and rollback share one lifetime rule.\n\n## Affected\n\n- `linux_kernel >= 6.7, < 6.12.97`\n- `linux_kernel >= 6.13, < 6.18.35`\n- `linux_kernel >= 6.19, < 7.0.12`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.12`\n\n## Vendor advisories\n\n- **RHSA-2026:77690** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77690)\n- **RHSA-2026:77689** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77689)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63970.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}