ACK: [SRU][N:hwe-6.17/N][PATCH 0/2] CVE-2026-53365

[Andrei Gherzan]

On 26/09/11 08:17AM, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53365
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> vsock/virtio: fix zerocopy completion for multi-skb sends
> 
> When a large message is fragmented into multiple skbs, the zerocopy uarg is
> only allocated and attached to the last skb in the loop. Non-final skbs carry
> pinned user pages with no completion tracking, so the kernel has no way to
> notify userspace when those pages are safe to reuse. If the loop breaks early
> the uarg is never allocated at all, leaking pinned pages with no completion
> notification.
> 
> Fix this by following the approach used by TCP: allocate the zerocopy uarg (if
> not provided by the caller) before the send loop and attach it to every skb via
> skb_zcopy_set(), which takes a reference per skb. Each skb's completion
> properly decrements the refcount, and the notification only fires after the
> last skb is freed. On failure, if no data was sent, the uarg is cleanly aborted
> via net_zcopy_put_abort().
> 
> This issue was initially discovered by sashiko while reviewing commit
> 1cb36e252211 ("vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting") but was
> pre-existing.
> 
> [ Fix ]
> 
> noble/linux-hwe-6.17: backported from ae38d9179190
> noble/linux: backported from ae38d9179190
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A bad fix in this area would affect systems using AF_VSOCK over the virtio
> transport with MSG_ZEROCOPY sends, primarily virtual machine guests and hosts
> that exchange large messages over vsock; a regression could show up as stalled
> or missing zerocopy completion notifications or as mishandled pinned user
> pages. Systems that do not use vsock, or that use vsock without the
> MSG_ZEROCOPY flag, are not affected by this change.
> 
> [ Other Info ]
> 
> Kybele flow-v11-25-ga27c0fa6. Reference: 557e55fa/v1

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260915/193291c7/attachment.sig>