Allocation of Resources Without Limits or Throttling in Linux kernel - CVE-2026-53132

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU135652

Allocation of Resources Without Limits or Throttling in Linux kernel - CVE-2026-53132

Published: June 26, 2026


Vulnerability identifier: #VU135652
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53132
CWE-ID: CWE-770
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in virtio_transport_inc_rx_pkt() and the virtio vsock receive queue when processing crafted packets with zero-length payloads and the VIRTIO_VSOCK_SEQ_EOM flag. A local user can send a large number of specially crafted packets to cause a denial of service.

The issue occurs because queued packets may not increase the tracked byte count, allowing the receive queue to grow excessively.


Affected software

Linux kernel
Ubuntu
openEuler
linux (Ubuntu package)
linux-lowlatency (Ubuntu package)
linux-raspi (Ubuntu package)
linux-azure (Ubuntu package)
linux-gcp (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oracle (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-realtime (Ubuntu package)
linux-lowlatency-hwe-6.8 (Ubuntu package)
linux-fips (Ubuntu package)
linux-azure-fde-6.8 (Ubuntu package)
linux-azure-6.8 (Ubuntu package)
linux-aws-6.8 (Ubuntu package)
linux-oracle-6.8 (Ubuntu package)
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-lowlatency (Ubuntu package)
linux-gkeop (Ubuntu package)
linux-nvidia-6.8 (Ubuntu package)
linux-gke (Ubuntu package)
linux-ibm-6.8 (Ubuntu package)
linux-gcp-6.8 (Ubuntu package)
linux-aws-fips (Ubuntu package)
linux-gcp-fips (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-raspi-realtime (Ubuntu package)
linux-realtime-6.8 (Ubuntu package)
linux-nvidia-bos (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-aws-7.0 (Ubuntu package)
linux-nvidia-7.0 (Ubuntu package)
kernel-tools-debuginfo
kernel
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools
kernel-source
kernel-headers
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
bpftool

How to mitigate CVE-2026-53132

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 6.8.0-146.146, 7.0.0-31.31
linux-lowlatency (Ubuntu package) - update to 6.8.0-146.146.1
linux-raspi (Ubuntu package) - addressed in versions 6.8.0-1068.72, 7.0.0-1019.19
linux-azure (Ubuntu package) - addressed in versions 6.8.0-1070.78, 7.0.0-1014.14
linux-gcp (Ubuntu package) - addressed in versions 6.8.0-1070.78, 7.0.0-1011.11
linux-aws (Ubuntu package) - addressed in versions 6.8.0-1066.69, 7.0.0-1012.12
linux-ibm (Ubuntu package) - addressed in versions 6.8.0-1066.67, 7.0.0-1013.13
linux-oracle (Ubuntu package) - addressed in versions 6.8.0-1063.66, 7.0.0-1011.11
linux-azure-fde (Ubuntu package) - update to 6.8.0-1068.75
linux-nvidia (Ubuntu package) - addressed in versions 6.8.0-1064.67, 7.0.0-1018.18
linux-realtime (Ubuntu package) - addressed in versions 6.8.1-1061.62, 7.0.0-31.31.1
linux-lowlatency-hwe-6.8 (Ubuntu package) - update to 6.8.0-146.146.1~22.04.1
linux-fips (Ubuntu package) - update to 6.8.0-146.146+fips1
linux-azure-fde-6.8 (Ubuntu package) - update to 6.8.0-1068.75~22.04.1
linux-azure-6.8 (Ubuntu package) - update to 6.8.0-1070.78~22.04.1
linux-aws-6.8 (Ubuntu package) - update to 6.8.0-1066.69~22.04.1
linux-oracle-6.8 (Ubuntu package) - update to 6.8.0-1067.71~22.04.1
linux-nvidia-tegra (Ubuntu package) - update to 6.8.0-1035.38
linux-nvidia-lowlatency (Ubuntu package) - update to 6.8.0-1064.67.1
linux-gkeop (Ubuntu package) - update to 6.8.0-1051.55
linux-nvidia-6.8 (Ubuntu package) - update to 6.8.0-1064.67~22.04.1
linux-gke (Ubuntu package) - addressed in versions 6.8.0-1065.73, 7.0.0-1006.7
linux-ibm-6.8 (Ubuntu package) - update to 6.8.0-1066.67~22.04.1
linux-gcp-6.8 (Ubuntu package) - update to 6.8.0-1070.78~22.04.1
linux-aws-fips (Ubuntu package) - update to 6.8.0-1066.69+fips1
linux-gcp-fips (Ubuntu package) - update to 6.8.0-1070.78+fips1
linux-azure-fips (Ubuntu package) - update to 6.8.0-1069.77+fips1
linux-raspi-realtime (Ubuntu package) - update to 6.8.0-2056.58
linux-realtime-6.8 (Ubuntu package) - update to 6.8.1-1061.62~22.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2018.18
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-31.31~24.04.1
linux-azure-7.0 (Ubuntu package) - update to 7.0.0-1014.14~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1013.13
linux-aws-7.0 (Ubuntu package) - update to 7.0.0-1012.12~24.04.1
linux-nvidia-7.0 (Ubuntu package) - update to 7.0.0-1018.18~24.04.1
kernel-tools-debuginfo - update to 6.6.0-145.1.20.157
kernel - update to 6.6.0-145.1.20.157
python3-perf-debuginfo - update to 6.6.0-145.1.20.157
python3-perf - update to 6.6.0-145.1.20.157
perf-debuginfo - update to 6.6.0-145.1.20.157
perf - update to 6.6.0-145.1.20.157
kernel-tools-devel - update to 6.6.0-145.1.20.157
kernel-tools - update to 6.6.0-145.1.20.157
kernel-source - update to 6.6.0-145.1.20.157
kernel-headers - update to 6.6.0-145.1.20.157
kernel-devel - update to 6.6.0-145.1.20.157
kernel-debugsource - update to 6.6.0-145.1.20.157
kernel-debuginfo - update to 6.6.0-145.1.20.157
bpftool-debuginfo - update to 6.6.0-145.1.20.157
bpftool - update to 6.6.0-145.1.20.157

External References

Related Security Bulletins