CVE-2026-53132 Overview
CVE-2026-53132 is a denial-of-service vulnerability in the Linux kernel's vsock/virtio transport layer. The flaw resides in the receive-path accounting logic used by virtio vsock to bound queued socket buffer (skb) memory. An attacker able to send vsock packets to a victim can submit a stream of zero-length packets carrying the VIRTIO_VSOCK_SEQ_EOM flag. These packets bypass coalescing and never increment vvs->rx_bytes, allowing the receive queue to grow without limit. The result is unbounded kernel memory consumption that can exhaust host or guest resources.
Critical Impact
A local or guest-side attacker can exhaust kernel memory by flooding the vsock transport with zero-length end-of-message packets, leading to denial of service.
Affected Products
- Linux kernel versions containing the virtio_transport_inc_rx_pkt() and virtio_transport_recv_enqueue() logic in net/vmw_vsock/virtio_transport_common.c
- Hosts and guests using virtio vsock for hypervisor-to-guest communication
- Distributions shipping affected stable kernel branches prior to the referenced fix commits
Discovery Timeline
- 2026-06-25 - CVE CVE-2026-53132 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53132
Vulnerability Analysis
The vulnerability is a resource exhaustion flaw in the virtio vsock receive path. The function virtio_transport_inc_rx_pkt() enforces buffer accounting by comparing vvs->rx_bytes + len against vvs->buf_alloc. This check relies on len accurately representing the memory cost of each queued skb.
The companion function virtio_transport_recv_enqueue() skips packet coalescing when a packet carries the VIRTIO_VSOCK_SEQ_EOM flag. Coalescing normally merges small payloads into existing skbs, keeping queue depth bounded. When coalescing is skipped, each incoming packet allocates and queues its own skb.
If an attacker submits packets where len == 0 and the VIRTIO_VSOCK_SEQ_EOM flag is set, vvs->rx_bytes never increases. The accounting check in virtio_transport_inc_rx_pkt() always passes, and the receive queue grows without bound. Each queued skb still consumes kernel memory through its metadata structures, even though its data length is zero.
Root Cause
The accounting logic measures only payload bytes, ignoring the fixed metadata cost of each skb. Zero-length packets therefore appear free to the bookkeeping code while still consuming real kernel memory. Combined with the coalescing bypass for end-of-message packets, this creates an unbounded queue condition.
Attack Vector
An attacker with the ability to send vsock packets to a target socket, such as a malicious guest targeting the host or a local process targeting another endpoint, transmits a high volume of zero-length packets with VIRTIO_VSOCK_SEQ_EOM set. The receiver queues each packet indefinitely. Memory pressure builds until the kernel triggers out-of-memory conditions or system instability.
The upstream fix estimates skb metadata cost by adding (number of skbs in the queue) * SKB_TRUESIZE(0) to the accounting comparison. This ensures the receive queue is bounded even when payload bytes are zero. See the kernel commit for the applied patch.
Detection Methods for CVE-2026-53132
Indicators of Compromise
- Sustained growth of kernel SUnreclaim or Slab memory on hosts running virtio vsock without corresponding application activity
- High counts of queued skbs on vsock sockets visible via ss --vsock or /proc/net/vsock style inspection where exposed
- Guest processes or peers transmitting large bursts of zero-length vsock packets
Detection Strategies
- Monitor kernel slab allocators for abnormal skbuff_head_cache growth, which signals queued skb buildup
- Track per-socket vsock receive queue depths and alert when depths exceed expected operational baselines
- Correlate hypervisor-reported guest memory pressure with vsock traffic patterns to identify malicious guests
Monitoring Recommendations
- Enable kernel tracepoints on net/vmw_vsock/virtio_transport_common.c paths in lab environments to characterize normal traffic
- Capture and review vsock traffic volumes between guests and hosts to baseline acceptable packet rates
- Alert on out-of-memory kill events involving processes that own vsock sockets
How to Mitigate CVE-2026-53132
Immediate Actions Required
- Apply the upstream Linux stable kernel patches referenced in the CVE advisory and reboot affected hosts and guests
- Audit which workloads use virtio vsock and restrict vsock access to trusted guests where feasible
- Track distribution security advisories for backported fixes to the kernel versions deployed in production
Patch Information
The fix is published across four Linux stable tree commits: 059b7dbd20a6, 100d5b2ffdc6, 1eca304f97a3, and 9bdc637fde66. The patches modify the receive accounting to include skb metadata overhead, preventing the unbounded queue condition.
Workarounds
- Disable the vhost_vsock or vmw_vsock_virtio_transport kernel modules on systems that do not require vsock functionality
- Apply hypervisor-level rate limiting on guest-to-host vsock traffic where the platform supports it
- Restrict guest workloads to trusted tenants until the kernel patch can be deployed across the fleet
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
