CVE-2026-53365: Linux Kernel Privilege Escalation Flaw

CVE-2026-53365 Overview

CVE-2026-53365 is a Linux kernel vulnerability in the vsock/virtio subsystem. It affects how zerocopy completions are handled when large messages fragment into multiple socket buffers (skbs). Only the final skb in the send loop received the zerocopy uarg, while earlier skbs carried pinned user pages without any completion tracking. If the loop exited early, the uarg was never allocated, leaking pinned pages and never notifying userspace.

The flaw was surfaced during review of an earlier fix for MSG_ZEROCOPY pinned-pages accounting but pre-existed that patch. The upstream fix mirrors the TCP approach, allocating the uarg before the send loop and attaching it to every skb through skb_zcopy_set().

Critical Impact
Local processes using MSG_ZEROCOPY over VSOCK can leak pinned kernel pages and receive no completion notifications, corrupting page accounting and enabling resource exhaustion.

Affected Products

Linux kernel vsock/virtio transport with MSG_ZEROCOPY support
Distributions shipping affected stable kernel branches referenced in the upstream commits
Virtualized guests and hosts leveraging VSOCK for host-guest communication

Discovery Timeline

2026-07-13 - CVE-2026-53365 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-53365

Vulnerability Analysis

The defect resides in the virtio VSOCK transport send path. When a caller submits a large payload with the MSG_ZEROCOPY flag, the kernel fragments the payload across multiple skbs. The original implementation allocated the zerocopy user argument (uarg) once and attached it only to the final skb in the loop.

Every non-final skb still referenced pinned user pages but lacked completion metadata. The kernel therefore had no mechanism to signal userspace when those pages became safe to reuse or free. Userspace could continue mutating buffers the kernel still considered in flight, or hold pinned memory indefinitely.

A second failure mode occurs when the send loop breaks early. In that path, the uarg allocation never happens at all, so pinned pages leak with no notification and no accounting recovery. The upstream commits 76b995bc57bd, ae38d9179190, and b3155f2b78db correct the behavior by allocating the uarg before the loop and attaching it to every skb via skb_zcopy_set(), which takes a per-skb reference. On failure with no data sent, the code cleanly aborts through net_zcopy_put_abort().

Root Cause

The root cause is incorrect zerocopy completion accounting across a multi-skb send loop. The single-uarg attachment model assumed one skb per send, so fragmenting a payload produced skbs that pinned pages without any refcounted completion state.

Attack Vector

Exploitation requires local access with the ability to open an AF_VSOCK socket and issue sendmsg() calls using MSG_ZEROCOPY. Repeatedly triggering fragmented sends, or forcing send-loop early exits, can leak pinned pages and destabilize accounting in the host or guest kernel. The vulnerability is not remotely reachable across untrusted networks. See the kernel commit references for the corrected send loop logic.

Detection Methods for CVE-2026-53365

Indicators of Compromise

Unexplained growth in pinned memory attributable to processes using VSOCK with MSG_ZEROCOPY
Missing or delayed MSG_ERRQUEUE completion notifications on VSOCK sockets after large sends
Processes holding VSOCK sockets open with steadily increasing RSS or pinned-page counters

Detection Strategies

Inventory running kernels against the fixed commit hashes 76b995bc57bd, ae38d9179190, and b3155f2b78db
Audit workloads that call sendmsg() on AF_VSOCK sockets with the MSG_ZEROCOPY flag
Correlate host memory pressure with VSOCK activity in virtualization hosts to identify leaking guests or agents

Monitoring Recommendations

Track /proc/meminfo and cgroup memory metrics for anomalous pinned-page counts on VSOCK-using hosts
Enable kernel tracepoints for skb zerocopy paths in test environments to validate patched behavior
Alert on unusual sendmsg() failure patterns from processes bound to AF_VSOCK

How to Mitigate CVE-2026-53365

Immediate Actions Required

Apply the stable-kernel updates containing commits 76b995bc57bd, ae38d9179190, and b3155f2b78db
Reboot affected hosts and virtual machines after installing patched kernels to activate the fix
Restrict access to AF_VSOCK sockets to trusted workloads while patch rollout is in progress

Patch Information

Upstream stable trees carry the fix in the following commits: 76b995bc57bd, ae38d9179190, and b3155f2b78db. Consume the fix through your distribution's kernel update channel once vendor advisories are published.

Workarounds

Disable MSG_ZEROCOPY usage in applications communicating over VSOCK until patched kernels are deployed
Constrain VSOCK usage to trusted guest agents and services via seccomp or namespace policy
Limit memory available to workloads that use MSG_ZEROCOPY over VSOCK to cap potential page-pinning impact

bash

# Verify the running kernel and check for VSOCK MSG_ZEROCOPY consumers
uname -r
ss -x -p | grep -i vsock
# Optionally block loading the virtio vsock transport where not required
echo 'blacklist vsock' | sudo tee /etc/modprobe.d/disable-vsock.conf
echo 'blacklist vmw_vsock_virtio_transport' | sudo tee -a /etc/modprobe.d/disable-vsock.conf