{"id":"CVE-2026-23069","title":"vsock/virtio: fix potential underflow in virtio_transport_get_credit()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix potential underflow in virtio_transport_get_credit()\n\nThe credit calculation in virtio_transport_get_credit() uses unsigned\narithmetic:\n\n  ret = vvs->…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < d96de882d6b99955604669d962ae14e94b66a551","Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < 02f9af192b98d15883c70dd41ac76d1b0217c899","Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < d05bc313788f0684b27f0f5b60c52a844669b542","Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < ec0f1b3da8061be3173d1c39faaf9504f91942c3","Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < 3ef3d52a1a9860d094395c7a3e593f3aa26ff012","Linux 4.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-10T20:41:19.172207Z"},"published":"2026-02-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T18:25:28.890Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23069","references":[{"url":"https://git.kernel.org/stable/c/d96de882d6b99955604669d962ae14e94b66a551"},{"url":"https://git.kernel.org/stable/c/02f9af192b98d15883c70dd41ac76d1b0217c899"},{"url":"https://git.kernel.org/stable/c/d05bc313788f0684b27f0f5b60c52a844669b542"},{"url":"https://git.kernel.org/stable/c/ec0f1b3da8061be3173d1c39faaf9504f91942c3"},{"url":"https://git.kernel.org/stable/c/3ef3d52a1a9860d094395c7a3e593f3aa26ff012"}],"tags":["cve.org"],"epss":0.00148,"epssPercentile":0.03651,"ingestedAt":"2026-10-19T18:35:50.108Z","slug":"CVE-2026-23069","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix potential underflow in virtio_transport_get_credit()\n\nThe credit calculation in virtio_transport_get_credit() uses unsigned\narithmetic:\n\n  ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);\n\nIf the peer shrinks its advertised buffer (peer_buf_alloc) while bytes\nare in flight, the subtraction can underflow and produce a large\npositive value, potentially allowing more data to be queued than the\npeer can handle.\n\nReuse virtio_transport_has_space() which already handles this case and\nadd a comment to make it clear why we are doing that.\n\n[Stefano: use virtio_transport_has_space() instead of duplicating the code]\n[Stefano: tweak the commit message]\n\n## Affected\n\n- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < d96de882d6b99955604669d962ae14e94b66a551`\n- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < 02f9af192b98d15883c70dd41ac76d1b0217c899`\n- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < d05bc313788f0684b27f0f5b60c52a844669b542`\n- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < ec0f1b3da8061be3173d1c39faaf9504f91942c3`\n- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < 3ef3d52a1a9860d094395c7a3e593f3aa26ff012`\n- `Linux 4.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}