vsock/virtio: cap TX credit to local buffer size

Summary

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: cap TX credit to local buffer size The virtio transports derives its TX credit directly from peer_buf_alloc, which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value. On the host side this means that the amount of data we are willing to queue for a connection is scaled by a guest-chosen buffer size, rather than the host's own vsock configuration. A malicious guest can advertise a large buffer and read slowly, causing the host to allocate a correspondingly large amount of sk_buff memory. The same thing would happen in the guest with a malicious host, since virtio transports share the same code base. Introduce a small helper, virtio_transport_tx_buf_size(), that returns min(peer_buf_alloc, buf_alloc), and use it wherever we consume peer_buf_alloc. This ensures the effective TX window is bounded by both the peer's advertised buffer and our own buf_alloc (already clamped to buffer_max_size via SO_VM_SOCKETS_BUFFER_MAX_SIZE), so a remote peer cannot force the other to queue more data than allowed by its own vsock settings. On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with 32 guest vsock connections advertising 2 GiB each and reading slowly drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only recovered after killing the QEMU process. That said, if QEMU memory is limited with cgroups, the maximum memory used will be limited. With this patch applied: Before: MemFree: ~61.6 GiB Slab: ~142 MiB SUnreclaim: ~117 MiB After 32 high-credit connections: MemFree: ~61.5 GiB Slab: ~178 MiB SUnreclaim: ~152 MiB Only ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest remains responsive. Compatibility with non-virtio transports: • VMCI uses the AF_VSOCK buffer knobs to size its queue pairs per socket based on the local vsk->buffer_* values; the remote side cannot enlarge those queues beyond what the local endpoint configured. • Hyper-V's vsock transport uses fixed-size VMBus ring buffers and an MTU bound; there is no peer-controlled credit field comparable to peer_buf_alloc, and the remote endpoint cannot drive in-flight kernel memory above those ring sizes. • The loopback path reuses virtio_transport_common.c, so it naturally follows the same semantics as the virtio transport. This change is limited to virtio_transport_common.c and thus affects virtio-vsock, vhost-vsock, and loopback, bringing them in line with the "remote window intersected with local policy" behaviour that VMCI and Hyper-V already effectively have. [Stefano: small adjustments after changing the previous patch] [Stefano: tweak the commit message]

Timeline

1. Feb 4, 2026, 4:08 PM UTCCVE published
2. Jun 10, 2026, 8:42 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 19, 2026, 6:25 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 06a8fc78367d070720af960dcecec917d3ae5f3b · fixed in fef7110ae5617555c792a2bb4d27878d84583adf; From 06a8fc78367d070720af960dcecec917d3ae5f3b · fixed in d9d5f222558b42f6277eafaaa6080966faf37676; From 06a8fc78367d070720af960dcecec917d3ae5f3b · fixed in c0e42fb0e054c2b2ec4ee80f48ccd256ae0227ce; From 06a8fc78367d070720af960dcecec917d3ae5f3b · fixed in 84ef86aa7120449828d1e0ce438c499014839711; From 06a8fc78367d070720af960dcecec917d3ae5f3b · fixed in 8ee784fdf006cbe8739cfa093f54d326cbf54037

• Linux Linux

  4.8

• KernelLinux

  From 4.8.0 · fixed in 6.1.162; From 6.2.0 · fixed in 6.6.122; From 6.7.0 · fixed in 6.12.68; From 6.13.0 · fixed in 6.18.8

References 5