SB2026102390 - Integer underflow in Linux kernel vmw_vsock

Description

This security bulletin contains information about 1 vulnerability.

1) Integer underflow (CVE-ID: CVE-2026-99062)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt VSOCK stream reception and socket readiness reporting.

The vulnerability exists due to an integer underflow in virtio_transport_read_skb() when dequeuing a partially consumed stream packet. A local user can trigger subtraction of the full packet length rather than the remaining unread length from rx_bytes to corrupt receive accounting, cause erroneous receive failures, and hide queued data from socket reads.

The demonstrated behavior involves a connected CID_LOCAL stream with an SK_SKB verdict.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/38bad3930b1185dd6c98db3dd342ddc123c6f3ef
• https://git.kernel.org/stable/c/a463f55c791b96cfd12df8b10ea737d45c80bb18
• https://git.kernel.org/stable/c/dd4b2f88ee517f9629d0d3dbfced02ffbc33e2dc
• https://git.kernel.org/stable/c/e4a0028b0d54b2c45e1dc8c0dd95fe3e9236f55b