CVE-2026-23069

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The virtio transport get credit() function in the Linux kernel contains a flaw related to credit calculation using unsigned arithmetic. Specifically, if the peer reduces its advertised buffer size (peer buf alloc) while data is being transmitted, the subtraction operation can result in an underflow, leading to a large positive value. This could allow more data to be queued than the peer can actually handle. The issue is addressed by reusing the virtio transport has space() function, which already accounts for this scenario, and adding a clarifying comment. The vulnerable calculation is: ret = vvs->peer buf alloc - (vvs->tx cnt - vvs->peer fwd cnt).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.