SB2026052984 - Use of uninitialized resource in Linux kernel vmw_vsock

Description

This security bulletin contains information about 1 vulnerability.

1) Use of uninitialized resource (CVE-ID: CVE-2026-46207)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to uninitialized memory exposure in virtio_transport_build_skb() when processing non-linear skbs for delivery to the vsockmon tap device. A local attacker can trigger handling of a specially crafted non-linear skb to disclose sensitive information.

The issue affects payload copying to the monitor interface, where no payload is copied and data remains uninitialized.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/06747f52ab157591cec7e5623a759473b66ef6f6
• https://git.kernel.org/stable/c/378b131a25bd1a5ee27ca199fe486c299d5350c5
• https://git.kernel.org/stable/c/3a3e3d90cbc79600544536723911657730759af3
• https://git.kernel.org/stable/c/52da6a74ca3de0fcda60301096b71534b3b18641