---
id: CVE-2026-63970
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vsock/virtio: bind uarg before filling zerocopy skb

  virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg
  before entering the send loop, but virtio_tr…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vsock/virtio: bind uarg before filling zerocopy skb

  virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg
  before entering the send loop, but virtio_tr…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
  - CWE-825
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.7, < 6.12.97'
  - 'linux_kernel >= 6.13, < 6.18.35'
  - 'linux_kernel >= 6.19, < 7.0.12'
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.12
published: '2026-07-19'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T19:38:05.180'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63970'
references:
  - url: 'https://git.kernel.org/stable/c/1e584c304cfb94a759417130b1fc6d30b30c4cce'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5d317573f1d48e76cce5fb6250452b6e4102e0fb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/72194f65050958e4c8e069adb6c5d89ef81ca197'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63970.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-63970'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2502411'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-63970'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63970'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026071959-CVE-2026-63970-1142@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:77690'
  - url: 'https://access.redhat.com/errata/RHSA-2026:77689'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00176
epssPercentile: 0.07115
ingestedAt: '2026-10-02T22:33:09.807Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:34:15.768672Z'
scores:
  nvd: 7.8
  vendor: 7
  cna: 7.8
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: bind uarg before filling zerocopy skb

virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg
before entering the send loop, but virtio_transport_alloc_skb() still
fills the skb before it inherits that uarg. When fixed-buffer vectored
zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach
managed frags and return -EMSGSIZE. The rollback path call kfree_skb()
to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so
skb_release_data() falls through to ordinary frag unref.

Pass the uarg into virtio_transport_alloc_skb() and bind it immediately
before virtio_transport_fill_skb(). This keeps control or no-payload skbs
untouched while ensuring success and rollback share one lifetime rule.

## Affected

- `linux_kernel >= 6.7, < 6.12.97`
- `linux_kernel >= 6.13, < 6.18.35`
- `linux_kernel >= 6.19, < 7.0.12`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.12`

## Vendor advisories

- **RHSA-2026:77690** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77690)
- **RHSA-2026:77689** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:77689)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63970.json)