CVE-2026-53365 vsock/virtio: fix zerocopy completion for multi-skb sends
A flaw in Linux kernel vsock/virtio zerocopy handling leaks pinned pages, potentially causing memory exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53365?
CVE-2026-53365 is a high-severity denial of service vulnerability in Linux kernel, published on 13 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: fix zerocopy completion for multi-skb sends
When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. Non-final skbs carry pinned user pages with no completion tracking, so the kernel has no way to notify userspace when those pages are safe to reuse. If the loop breaks early the uarg is never allocated at all, leaking pinned pages with no completion notification.
Fix this by following the approach used by TCP: allocate the zerocopy uarg (if not provided by the caller) before the send loop and attach it to every skb via skb_zcopy_set(), which takes a reference per skb. Each skb's completion properly decrements the refcount, and the notification only fires after the last skb is freed. On failure, if no data was sent, the uarg is cleanly aborted via net_zcopy_put_abort().
This issue was initially discovered by sashiko while reviewing commit 1cb36e252211 ("vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting") but was pre-existing.
Which versions are affected by CVE-2026-53365?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53365?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-53365 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53365 exists.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53365, DEBIAN-CVE-2026-53365, GHSA-9p63-4jq7-2c9w, ROOT-OS-DEBIAN-13-CVE-2026-53365, ROOT-OS-UBUNTU-2404-CVE-2026-53365, UBUNTU-CVE-2026-53365.