---
id: CVE-2026-23069
title: 'vsock/virtio: fix potential underflow in virtio_transport_get_credit()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vsock/virtio: fix potential underflow in virtio_transport_get_credit()

  The credit calculation in virtio_transport_get_credit() uses unsigned
  arithmetic:

    ret = vvs->…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b <
    d96de882d6b99955604669d962ae14e94b66a551
  - >-
    Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b <
    02f9af192b98d15883c70dd41ac76d1b0217c899
  - >-
    Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b <
    d05bc313788f0684b27f0f5b60c52a844669b542
  - >-
    Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b <
    ec0f1b3da8061be3173d1c39faaf9504f91942c3
  - >-
    Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b <
    3ef3d52a1a9860d094395c7a3e593f3aa26ff012
  - Linux 4.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-10T20:41:19.172207Z'
published: '2026-02-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:25:28.890Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23069'
references:
  - url: 'https://git.kernel.org/stable/c/d96de882d6b99955604669d962ae14e94b66a551'
  - url: 'https://git.kernel.org/stable/c/02f9af192b98d15883c70dd41ac76d1b0217c899'
  - url: 'https://git.kernel.org/stable/c/d05bc313788f0684b27f0f5b60c52a844669b542'
  - url: 'https://git.kernel.org/stable/c/ec0f1b3da8061be3173d1c39faaf9504f91942c3'
  - url: 'https://git.kernel.org/stable/c/3ef3d52a1a9860d094395c7a3e593f3aa26ff012'
tags:
  - cve.org
epss: 0.00148
epssPercentile: 0.03651
ingestedAt: '2026-10-19T18:35:50.108Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: fix potential underflow in virtio_transport_get_credit()

The credit calculation in virtio_transport_get_credit() uses unsigned
arithmetic:

  ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);

If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes
are in flight, the subtraction can underflow and produce a large
positive value, potentially allowing more data to be queued than the
peer can handle.

Reuse virtio_transport_has_space() which already handles this case and
add a comment to make it clear why we are doing that.

[Stefano: use virtio_transport_has_space() instead of duplicating the code]
[Stefano: tweak the commit message]

## Affected

- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < d96de882d6b99955604669d962ae14e94b66a551`
- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < 02f9af192b98d15883c70dd41ac76d1b0217c899`
- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < d05bc313788f0684b27f0f5b60c52a844669b542`
- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < ec0f1b3da8061be3173d1c39faaf9504f91942c3`
- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < 3ef3d52a1a9860d094395c7a3e593f3aa26ff012`
- `Linux 4.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.