Main
Vulnerability Database
Exploits
ID:12962 - Exploit for Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-53365
ID:12962 - Exploit for Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-53365
Published: August 21, 2026
Vulnerability identifier: #VU137403
Vulnerability risk: Low
CVE-ID: CVE-2026-53365
CWE-ID: CWE-772
Exploitation vector: Local access
Vulnerable software:
Linux kernel
Debian Linux
Ubuntu
linux (Debian package)
linux (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure (Ubuntu package)
linux-aws (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)
Linux kernel
Debian Linux
Ubuntu
linux (Debian package)
linux (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure (Ubuntu package)
linux-aws (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)
Link to public exploit:
Vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in virtio vsock zerocopy completion handling in net/vmw_vsock/virtio_transport_common.c when processing multi-skb MSG_ZEROCOPY sends. A local user can send a large crafted message that is fragmented into multiple skbs to cause a denial of service.
The issue can leave pinned user pages without completion notification, including when the send loop exits before the final skb is processed.
Remediation
Install security update from vendor's repository.