SB2026071412 - Missing Release of Resource after Effective Lifetime in Linux kernel vmw_vsock

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-53365)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in virtio vsock zerocopy completion handling in net/vmw_vsock/virtio_transport_common.c when processing multi-skb MSG_ZEROCOPY sends. A local user can send a large crafted message that is fragmented into multiple skbs to cause a denial of service.

The issue can leave pinned user pages without completion notification, including when the send loop exits before the final skb is processed.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/76b995bc57bd90cb6e954e1966fbd8786da47f0d
• https://git.kernel.org/stable/c/ae38d9179190a956e2a87a69ef1dd6f451b51c4d
• https://git.kernel.org/stable/c/b3155f2b78db21e99256bcf7eb902f24ff6d5338