FlawAtlas
Search the atlas
CVE-2026-23069 Not scored

vsock/virtio: fix potential underflow in virtio_transport_get_credit()

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential underflow in virtio_transport_get_credit() The credit calculation in virtio_transport_get_credit() uses unsigned arithmetic: ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes are in flight, the subtraction can underflow and produce a large positive value, potentially allowing more data to be queued than the peer can handle. Reuse virtio_transport_has_space() which already handles this case and add a comment to make it clear why we are doing that. [Stefano: use virtio_transport_has_space() instead of duplicating the code] [Stefano: tweak the commit message]

Exploit probability 0.1%
Published February 4, 2026
Required by Not available
Last source change July 15, 2026

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown
Linux Kernel

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2026:20416-1
related SUSE-SU-2026:0962-1
related SUSE-SU-2026:1078-1
related SUSE-SU-2026:1081-1
related SUSE-SU-2026:20838-1
related SUSE-SU-2026:20931-1
related SUSE-SU-2026:21114-1
related SUSE-SU-2026:21123-1
related SUSE-SU-2026:21255-1
related SUSE-SU-2026:21284-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2026-23069

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential underflow in virtio_transport_get_credit() The credit calculation in virtio_transport_get_credit() uses unsigned arithmetic: ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); If the peer shrinks its advertised buffer (peer_buf_alloc) while bytes are in flight, the subtraction can underflow and produce a large positive value, potentially allowing more data to be queued than the peer can handle. Reuse virtio_transport_has_space() which already handles this case and add a comment to make it clear why we are doing that. [Stefano: use virtio_transport_has_space() instead of duplicating the code] [Stefano: tweak the commit message]

View original source

05 / REFERENCES

Further evidence