CVE-2026-63970

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vsock/virtio component where virtio transport send pkt info() allocates or reuses the zerocopy uarg before the send loop, but virtio transport alloc skb() fills the skb before inheriting that uarg. When fixed-buffer vectored zerocopy reaches MAX SKB FRAGS, the io sg from iter() function may partially attach managed fragments and return -EMSGSIZE. The subsequent rollback path calls kfree skb() to free an skb that contains SKBFL MANAGED FRAG REFS but lacks a uarg, causing skb release data() to default to ordinary fragment unreferencing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.