CVE-2026-52994 Overview
CVE-2026-52994 is a Linux kernel vulnerability in the vsock/virtio transport layer affecting MSG_ZEROCOPY pinned-pages accounting. The function virtio_transport_init_zcopy_skb() passes iter->count to msg_zerocopy_realloc(), which forwards the value to mm_account_pinned_pages() for RLIMIT_MEMLOCK accounting. Because virtio_transport_fill_skb() already consumes the iterator via __zerocopy_sg_from_iter() before this call, iter->count reaches zero on the last skb. The kernel therefore skips RLIMIT_MEMLOCK enforcement on zero-copy virtio socket transmissions.
Critical Impact
Local users can bypass per-process locked-memory limits by sending zero-copy data over virtio sockets, enabling resource exhaustion of pinned kernel memory.
Affected Products
- Linux kernel mainline branches containing vsock/virtio zero-copy support
- Stable kernel trees prior to the fix commits referenced in git.kernel.org commit 1cb36e2
- Distributions shipping vulnerable backports of the virtio vsock transport
Discovery Timeline
- 2026-06-24 - CVE CVE-2026-52994 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52994
Vulnerability Analysis
The defect resides in the virtio socket zero-copy transmission path. When a process sends data with the MSG_ZEROCOPY flag over an AF_VSOCK socket, the kernel pins user pages and accounts the pinned memory against the calling process's RLIMIT_MEMLOCK quota. The accounting call relies on the size argument passed to msg_zerocopy_realloc(). The vsock implementation reads this size from the iov_itercount field after the iterator has already been consumed by __zerocopy_sg_from_iter(). On the final skb in a multi-fragment transmission, iter->count equals zero, so mm_account_pinned_pages() accounts zero bytes and never enforces the locked-memory limit.
Root Cause
The root cause is incorrect ordering of size-tracking logic. virtio_transport_init_zcopy_skb() reads the iterator size after consumption rather than capturing the original pkt_len. TCP and UDP zero-copy paths avoid this issue by passing the message length explicitly to msg_zerocopy_realloc(). The fix introduces pkt_len as an explicit parameter, restoring parity with other zero-copy transports.
Attack Vector
A local unprivileged process with access to an AF_VSOCK socket can repeatedly transmit zero-copy payloads, pinning user pages beyond its configured RLIMIT_MEMLOCK quota. Because accounting underreports pinned pages, the process can exhaust system-wide pinned memory and induce denial of service against host or guest workloads relying on locked memory.
No verified exploit code is available. Refer to the upstream patches at commit 6af1736b and commit d0117950 for the corrected accounting logic.
Detection Methods for CVE-2026-52994
Indicators of Compromise
- Sustained growth of kernel pinned-page counters (/proc/meminfoMlocked) without matching user-space mlock() activity
- Processes with active AF_VSOCK sockets sending MSG_ZEROCOPY traffic while reporting low VmLck values in /proc/<pid>/status
- Out-of-memory events on virtualization hosts correlated with vsock workloads
Detection Strategies
- Audit kernel versions across Linux fleets and flag hosts without the upstream fix commits applied
- Monitor socket() syscalls creating AF_VSOCK descriptors followed by setsockopt() calls enabling SO_ZEROCOPY
- Correlate vsock zero-copy send activity with kernel memory pressure metrics to detect accounting drift
Monitoring Recommendations
- Collect kernel version inventory and dmesg output centrally to identify unpatched virtio vsock implementations
- Track per-process VmPin and VmLck values for workloads using virtio sockets
- Alert when virtualization host pinned memory exceeds expected baselines tied to running guest workloads
How to Mitigate CVE-2026-52994
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the NVD entry to all affected hosts and guests
- Restrict access to AF_VSOCK sockets to trusted workloads where feasible using LSM policies or seccomp filters
- Reduce per-process RLIMIT_MEMLOCK defaults on multi-tenant hosts until patches are deployed
Patch Information
The fix passes pkt_len as an explicit parameter to virtio_transport_init_zcopy_skb() instead of relying on the consumed iterator count. The patches are available at commit 1cb36e2, commit 6af1736b, and commit d0117950. Distribution maintainers are backporting these commits to supported stable kernel trees.
Workarounds
- Disable SO_ZEROCOPY for virtio socket workloads where the feature is not required
- Block creation of AF_VSOCK sockets via seccomp profiles on hosts that do not require guest-host vsock communication
- Lower system-wide RLIMIT_MEMLOCK ceilings to constrain pinned-memory abuse pending patch deployment
# Configuration example: restrict vsock socket creation via seccomp policy
# /etc/systemd/system/<service>.d/override.conf
[Service]
SystemCallFilter=~socket
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
LimitMEMLOCK=65536
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
