CVE-2026-53132: Linux Kernel Vsock Memory Exhaustion Denial of Service

Technical summary

The vulnerability exists in virtio_transport_recv_enqueue() within the Linux kernel's virtio vsock implementation. The function checks rx_bytes + len against buf_alloc to prevent queue overflow, but this check fails when packets have len == 0 and the VIRTIO_VSOCK_SEQ_EOM flag set. Under normal conditions, virtio_transport_inc_rx_pkt() would reject such packets; however, the EOM flag causes the coalescing logic to be skipped, allowing these zero-byte packets to be queued individually. Since rx_bytes never increases (packets carry no data), an attacker can queue arbitrarily many packets, each consuming kernel memory for skb metadata via SKB_TRUESIZE(0). The fix accounts for this by tracking the cumulative memory cost of queued skbs rather than relying solely on payload byte count.

Business impact

This vulnerability enables local denial-of-service attacks against systems running vulnerable kernel versions. Production environments using virtio vsock for inter-VM communication or containerized workloads are at particular risk. An attacker with local user privileges can trigger memory exhaustion, causing system unresponsiveness, service interruptions, and potential cascading failures in cloud infrastructure or virtualized deployments. Organizations relying on overcommitted memory models or running memory-intensive workloads face elevated risk of operational disruption.

Affected systems

All versions of the Linux kernel prior to the patch are affected. The vulnerability specifically impacts systems using the virtio vsock transport, which is common in KVM/QEMU virtualized environments, cloud instances, and container runtimes. Physical systems not using vsock are unaffected. The issue manifests in both host and guest kernel instances where vsock communication is active.

Exploitability

Exploitation requires local access to the affected system (CWE-401 related to resource mismanagement). No authentication is required, and an unprivileged user can trigger the attack. The attack is straightforward—send specially crafted vsock packets with zero length and EOM flags—making it practical for local privilege escalation or denial-of-service scenarios. The CVSS score of 7.1 reflects the high severity due to system scope impact and availability compromise, though exploitation is confined to local attackers.

Remediation

Apply the kernel patch that implements proper memory accounting for skb metadata. Rather than relying on payload bytes alone, the fix tracks the true memory overhead of queued skbs by multiplying the number of pending packets by SKB_TRUESIZE(0) and enforcing this against buf_alloc. Organizations must rebuild and redeploy affected kernel versions or apply vendor backports available through their distribution.

Patch guidance

Consult your Linux distribution's security advisories for patched kernel versions. Major distributions (Red Hat, Debian, Ubuntu, SUSE) will release updates through their standard channels. For systems running upstream or custom kernels, apply the fix from the Linux kernel repository once available. Test patches in a staging environment first, as kernel updates require system reboot and may affect performance-sensitive deployments. Verify patch application by checking kernel version and release notes confirming the vsock memory accounting fix.

Detection guidance

Monitor for sustained growth in vsock queue depths or memory pressure in systems using virtio vsock. Kernel memory counters related to skb allocation can signal attack activity. Audit local user activity for unusual socket creation patterns via vsock. Network intrusion detection is not practical (this is local-only), but host-based monitoring of memory exhaustion events correlated with vsock activity may reveal attempts. Examine kernel logs for memory allocation failures or OOM killer invocations on systems under attack.

Why prioritize this

Prioritize based on deployment model: systems using KVM/QEMU virtualization, container platforms with vsock enabled, or cloud environments relying on virtio transport should patch urgently. While local-only exploitability limits blast radius, the ease of triggering and high availability impact (CVSS 7.1) warrant rapid remediation in multi-tenant or shared environments. Single-user workstations and systems not using vsock can defer but should not ignore this issue indefinitely.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH severity) reflects: local attack vector (AV:L), low complexity attack requiring only malformed packet transmission (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and scope change affecting system-wide availability (S:C). While confidentiality and integrity are unaffected (C:N, I:N), the availability impact is high (A:H) due to denial-of-service through memory exhaustion. The score appropriately emphasizes the threat to service continuity in virtualized and multi-tenant environments.

Frequently asked questions