{"id":14983,"date":"2026-09-04T19:02:20","date_gmt":"2026-09-04T11:02:20","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-63970"},"modified":"2026-09-04T19:02:20","modified_gmt":"2026-09-04T11:02:20","slug":"cve-2026-63970","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-63970","title":{"rendered":"CVE-2026-63970 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nvsock\/virtio: bind ua"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>vsock\/virtio: bind uarg before filling zerocopy skb<\/p>\n<p>virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg<br \/>\nbefore entering the send loop, but virtio_transport_alloc_skb() still<br \/>\nfills the skb before it inherits that uarg. When fixed-buffer vectored<br \/>\nzerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach<br \/>\nmanaged frags and return -EMSGSIZE. The rollback path call kfree_skb()<br \/>\nto free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so<br \/>\nskb_release_data() falls through to ordinary frag unref.<\/p>\n<p>Pass the uarg into virtio_transport_alloc_skb() and bind it immediately<br \/>\nbefore virtio_transport_fill_skb(). This keeps control or no-payload skbs<br \/>\nuntouched while ensuring success and rollback share one lifetime rule.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>vsock\/virtio: bind uarg before filling zerocopy skb<\/p>\n<p>virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg<br \/>\nbefore <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14983","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14983","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14983"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14983"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14983"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}