CVE-2026-23086 — Linux vulnerability
8 documents8 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 95.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 4
Latest updateFeb 10
Description
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: cap TX credit to local buffer size
The virtio transports derives its TX credit directly from peer_buf_alloc,
which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value.
On the host side this means that the amount of data we are willing to
queue for a connection is scaled by a guest-chosen buffer size, rather
than the host's own vsock configuration. A malicious guest can advertise
a large buffer and …
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages3 packages
▶CVEListV5linux/linux06a8fc78367d070720af960dcecec917d3ae5f3b — fef7110ae5617555c792a2bb4d27878d84583adf+5
Patches
🔴Vulnerability Details
3OSV▶
CVE-2026-23086: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: cap TX credit to local buffer size The virtio transports derives its↗2026-02-04
GHSA▶
GHSA-45gq-hr3j-jmrq: In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: cap TX credit to local buffer size
The virtio transports derives i↗2026-02-04