---
id: CVE-2026-23086
title: 'vsock/virtio: cap TX credit to local buffer size'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vsock/virtio: cap TX credit to local buffer size

  The virtio transports derives its TX credit directly from peer_buf_alloc,
  which is set from the remote endpoint's SO_V…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b <
    fef7110ae5617555c792a2bb4d27878d84583adf
  - >-
    Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b <
    d9d5f222558b42f6277eafaaa6080966faf37676
  - >-
    Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b <
    c0e42fb0e054c2b2ec4ee80f48ccd256ae0227ce
  - >-
    Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b <
    84ef86aa7120449828d1e0ce438c499014839711
  - >-
    Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b <
    8ee784fdf006cbe8739cfa093f54d326cbf54037
  - Linux 4.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-10T20:42:20.829487Z'
published: '2026-02-04'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T08:44:49.490Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23086'
references:
  - url: 'https://git.kernel.org/stable/c/fef7110ae5617555c792a2bb4d27878d84583adf'
  - url: 'https://git.kernel.org/stable/c/d9d5f222558b42f6277eafaaa6080966faf37676'
  - url: 'https://git.kernel.org/stable/c/c0e42fb0e054c2b2ec4ee80f48ccd256ae0227ce'
  - url: 'https://git.kernel.org/stable/c/84ef86aa7120449828d1e0ce438c499014839711'
  - url: 'https://git.kernel.org/stable/c/8ee784fdf006cbe8739cfa093f54d326cbf54037'
tags:
  - cve.org
epss: 0.00151
epssPercentile: 0.03559
ingestedAt: '2026-09-08T15:33:26.993Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: cap TX credit to local buffer size

The virtio transports derives its TX credit directly from peer_buf_alloc,
which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value.

On the host side this means that the amount of data we are willing to
queue for a connection is scaled by a guest-chosen buffer size, rather
than the host's own vsock configuration. A malicious guest can advertise
a large buffer and read slowly, causing the host to allocate a
correspondingly large amount of sk_buff memory.
The same thing would happen in the guest with a malicious host, since
virtio transports share the same code base.

Introduce a small helper, virtio_transport_tx_buf_size(), that
returns min(peer_buf_alloc, buf_alloc), and use it wherever we consume
peer_buf_alloc.

This ensures the effective TX window is bounded by both the peer's
advertised buffer and our own buf_alloc (already clamped to
buffer_max_size via SO_VM_SOCKETS_BUFFER_MAX_SIZE), so a remote peer
cannot force the other to queue more data than allowed by its own
vsock settings.

On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with
32 guest vsock connections advertising 2 GiB each and reading slowly
drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only
recovered after killing the QEMU process. That said, if QEMU memory is
limited with cgroups, the maximum memory used will be limited.

With this patch applied:

  Before:
    MemFree:        ~61.6 GiB
    Slab:           ~142 MiB
    SUnreclaim:     ~117 MiB

  After 32 high-credit connections:
    MemFree:        ~61.5 GiB
    Slab:           ~178 MiB
    SUnreclaim:     ~152 MiB

Only ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest
remains responsive.

Compatibility with non-virtio transports:

  - VMCI uses the AF_VSOCK buffer knobs to size its queue pairs per
    socket based on the local vsk->buffer_* values; the remote side
    cannot enlarge those queues beyond what the local endpoint
    configured.

  - Hyper-V's vsock transport uses fixed-size VMBus ring buffers and
    an MTU bound; there is no peer-controlled credit field comparable
    to peer_buf_alloc, and the remote endpoint cannot drive in-flight
    kernel memory above those ring sizes.

  - The loopback path reuses virtio_transport_common.c, so it
    naturally follows the same semantics as the virtio transport.

This change is limited to virtio_transport_common.c and thus affects
virtio-vsock, vhost-vsock, and loopback, bringing them in line with the
"remote window intersected with local policy" behaviour that VMCI and
Hyper-V already effectively have.

[Stefano: small adjustments after changing the previous patch]
[Stefano: tweak the commit message]

## Affected

- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < fef7110ae5617555c792a2bb4d27878d84583adf`
- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < d9d5f222558b42f6277eafaaa6080966faf37676`
- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < c0e42fb0e054c2b2ec4ee80f48ccd256ae0227ce`
- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < 84ef86aa7120449828d1e0ce438c499014839711`
- `Linux >= 06a8fc78367d070720af960dcecec917d3ae5f3b < 8ee784fdf006cbe8739cfa093f54d326cbf54037`
- `Linux 4.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.