CVE-2026-52994: Linux Kernel vsock/virtio MSG_ZEROCOPY Memory Accounting Bypass

Technical summary

CVE-2026-52994 affects the vsock/virtio subsystem in the Linux kernel. The vulnerability exists in virtio_transport_init_zcopy_skb(), which uses iter->count to determine the size argument passed to msg_zerocopy_realloc() for RLIMIT_MEMLOCK accounting. Since this function is called after __zerocopy_sg_from_iter() consumes the iterator, iter->count becomes 0 on the final skb, causing the memory accounting check to be skipped. The fix passes pkt_len (total bytes being transmitted) as an explicit parameter instead of relying on the consumed iterator state, aligning the behavior with TCP and UDP implementations.

Business impact

This vulnerability enables local denial-of-service attacks by allowing unprivileged users to exhaust system memory resources beyond their configured limits. On systems relying on resource controls to isolate tenant workloads (shared hosting, containerized environments), an attacker could trigger out-of-memory conditions affecting other users or critical services. The impact is localized to systems using virtio-based virtual sockets, which are common in cloud and virtualized deployments.

Affected systems

The Linux kernel is affected across versions that include the vulnerable vsock/virtio code. This issue is most relevant to systems using virtio transports for vsock, particularly in virtualized and cloud environments (KVM, Xen, cloud platforms). Non-virtualized standalone systems or those not using vsock functionality are unaffected.

Exploitability

Exploitation requires local access and the ability to establish vsock connections with zero-copy messaging (MSG_ZEROCOPY flag). An unprivileged local user can trigger the flaw by sending large messages via virtio-based vsock, progressively exhausting RLIMIT_MEMLOCK allowances beyond the enforced limit. The attack is straightforward once local access is obtained but has no network-based attack surface.

Remediation

Apply kernel updates containing the fix to virtio_transport_init_zcopy_skb(). Verify the patch against your Linux distribution's security advisory to confirm the specific version incorporating this resolution. Temporary mitigations include reducing RLIMIT_MEMLOCK limits per-user or disabling MSG_ZEROCOPY for untrusted workloads if operationally feasible, though patching is the recommended approach.

Patch guidance

Obtain updates from your Linux distribution's security repository. Major distributions (Red Hat, Debian, Ubuntu, SUSE) will backport this fix to their supported kernel versions. Check your vendor's security advisory for the specific kernel version numbers containing the fix. Apply patches during your regular maintenance windows, prioritizing systems running virtualized workloads or supporting multi-tenant environments.

Detection guidance

Monitor audit logs for successful vsock connections originating from unprivileged processes combined with MSG_ZEROCOPY message sends. Watch for RLIMIT_MEMLOCK accounting anomalies or sudden memory pinning events that exceed expected usage. System administrators can also track kernel updates from distribution vendors to confirm patch application. Memory pressure indicators and out-of-memory killer events from unprivileged users may signal exploitation attempts.

Why prioritize this

This is a local denial-of-service vulnerability with medium CVSS score (5.5) that bypasses resource controls in multi-tenant environments. While it requires local access and does not enable privilege escalation or data exfiltration, it threatens availability in cloud and shared hosting contexts where resource isolation is a security boundary. Prioritize patching for systems with untrusted local users or multi-tenant workloads.

Risk score, explained

CVSS 5.5 reflects a local attack vector (AV:L), low complexity (AC:L), and requirement for local user privileges (PR:L), with no impact to confidentiality or integrity. The scoring emphasizes the availability impact (A:H) from resource exhaustion. The absence from CISA's KEV catalog indicates no active in-the-wild exploitation, supporting a measured but timely response.

Frequently asked questions