CVE-2026-23057: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23057 is a Linux kernel vulnerability in the vsock/virtio subsystem where non-linear socket buffers (skbs) may be incorrectly coalesced during receive queue processing, leading to data loss and exposure of uninitialized kernel memory. The flaw was introduced with the addition of MSG_ZEROCOPY support, which invalidated the prior assumption that small skbs are always linear. It affects Linux kernel versions from commit 581512a6dc93 up to (but not including) the patched commits, with fixes backported to stable releases 6.12.68, 6.18.8, and 6.19-rc7. The vulnerability was published on February 4, 2026, with an EPSS score of approximately 0.017% (Feedly, EUVD).

The root cause is an improper assumption in the vsock/virtio common receive path: when coalescing buffers, the code assumes that any small skb (up to GOOD_COPY_LEN = 128 bytes) following a linear skb with spare tail room is itself linear. Since MSG_ZEROCOPY support was introduced, non-linear (fragmented) skbs can appear in this position. When a non-linear skb is coalesced into a linear one, the data from the non-linear skb is lost and the linear skb's tail is filled with uninitialized kernel memory instead (CWE-908: Use of Uninitialized Resource). Of the three virtio-based transports, only the loopback transport is affected: G2H virtio-transport always allocates explicitly linear skbs, and H2G vhost-transport only allocates non-linear skbs for sizes above the coalescence threshold. The fix ensures coalescing is only attempted when skb_tailroom(last_skb) > 0, which guarantees linearity (Feedly, EUVD).

Exploitation of this vulnerability can result in two distinct consequences: data loss (the payload of the non-linear skb is silently dropped) and information disclosure (uninitialized kernel memory is appended to the receive buffer and potentially delivered to a userspace application). The information disclosure risk is limited to processes communicating over vsock loopback transport on affected kernel versions, and does not directly enable remote code execution or privilege escalation. The scope is constrained to local virtual machine environments using the loopback vsock transport (Feedly, EUVD).

The Linux kernel maintainers have released patches addressing this vulnerability in stable branches. Fixed versions include Linux 6.12.68, 6.18.8, and 6.19-rc7. Patches are available via the upstream stable kernel repository at the following commits: 568e9cd8ed7c, 63ef9b300bd0, and 0386bd321d0f. Downstream distributions including SUSE, Oracle Linux, and Ubuntu have issued updated kernel packages incorporating these fixes (e.g., Ubuntu USN-8278-1, USN-8289-1, USN-8296-1, USN-8278-2, USN-8289-2, USN-8296-2). Users should update to a patched kernel version as soon as possible; no configuration-based workaround is available other than avoiding use of MSG_ZEROCOPY over vsock loopback transport (Feedly, Ubuntu USN-8278-1, EUVD).