CVE-2026-53132

HighCVSS 7.1/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: fix potential unbounded skb queue

virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc.

virtio_transport_recv_enqueue() skips coalescing for packets with VIRTIO_VSOCK_SEQ_EOM.

If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, a very large number of packets can be queued because vvs->rx_bytes stays at 0.

Fix this by estimating the skb metadata size:

(Number of skbs in the queue) * SKB_TRUESIZE(0)

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-401CWE-400

Affected software

VendorProductVersions
LinuxLinux>= 077706165717686a2a6a71405fef036cd5b37ae0, < 1eca304f97a34ed5e921e1f0e06c8b241f25bf12; >= 077706165717686a2a6a71405fef036cd5b37ae0, < 9bdc637fde66b63d6cad0caacd034888bb7bf5f5; >= 077706165717686a2a6a71405fef036cd5b37ae0, < 100d5b2ffdc6468b9e48532641f29e83efdcb63c; >= 077706165717686a2a6a71405fef036cd5b37ae0, < 059b7dbd20a6f0c539a45ddff1573cb8946685b5; 5852a2b573f7a3a29df46296e56aa3491e589cdf; >= 6.1.63, < 6.2
LinuxLinux6.3

References

Timeline

Published
Jun 25, 2026
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-531337.8In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix truncation for block sizes >= 4G When the iommu is usedCVE-2026-531345.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_fib: fix stale stack leak via the OIFNAME register For CVE-2026-531355.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs [WCVE-2026-531367.8In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size CVE-2026-531377.8In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size [Why CVE-2026-531387.1In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS record-chain walk loops [Why & How] All rCVE-2026-531395.5In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Skip CSD when it has zeroed workgroups A compute shader dispaCVE-2026-53148.8A vulnerability was found in Nothings stb up to 1.26. Impacted is the function stbtt_InitFont_internal in the library stb_truetype.h of the CVE-2026-531405.5In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups v3d_reCVE-2026-531415.5In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix global performance monitor reference counting In the SET_CVE-2026-531425.5In the Linux kernel, the following vulnerability has been resolved: drm/xe/display: fix oops in suspend/shutdown without display The xe drCVE-2026-531437.8In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX