{"id":"CVE-2026-23069","revision":"a94090f5fc9245c0be1efe6a4327eba8","records":[{"revision":"a94090f5fc9245c0be1efe6a4327eba8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-23069","aliases":[],"title":"vsock/virtio: fix potential underflow in virtio_transport_get_credit()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix potential underflow in virtio_transport_get_credit()\n\nThe credit calculation in virtio_transport_get_credit() uses unsigned\narithmetic:\n\n  ret = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt);\n\nIf the peer shrinks its advertised buffer (peer_buf_alloc) while bytes\nare in flight, the subtraction can underflow and produce a large\npositive value, potentially allowing more data to be queued than the\npeer can handle.\n\nReuse virtio_transport_has_space() which already handles this case and\nadd a comment to make it clear why we are doing that.\n\n[Stefano: use virtio_transport_has_space() instead of duplicating the code]\n[Stefano: tweak the commit message]","state":0,"publishedAt":"2026-02-04T16:07:49.911+00:00","modifiedAt":"2026-10-19T18:25:28.89+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/vmw_vsock/virtio_transport_common.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"06a8fc78367d070720af960dcecec917d3ae5f3b\",\n                            \"lessThan\": \"d96de882d6b99955604669d962ae14e94b66a551\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"06a8fc78367d070720af960dcecec917d3ae5f3b\",\n                            \"lessThan\": \"02f9af192b98d15883c70dd41ac76d1b0217c899\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"06a8fc78367d070720af960dcecec917d3ae5f3b\",\n                            \"lessThan\": \"d05bc313788f0684b27f0f5b60c52a844669b542\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"06a8fc78367d070720af960dcecec917d3ae5f3b\",\n                            \"lessThan\": \"ec0f1b3da8061be3173d1c39faaf9504f91942c3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"06a8fc78367d070720af960dcecec917d3ae5f3b\",\n                            \"lessThan\": \"3ef3d52a1a9860d094395c7a3e593f3aa26ff012\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/vmw_vsock/virtio_transport_common.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.162\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.122\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.68\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.8\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/d96de882d6b99955604669d962ae14e94b66a551","https://git.kernel.org/stable/c/02f9af192b98d15883c70dd41ac76d1b0217c899","https://git.kernel.org/stable/c/d05bc313788f0684b27f0f5b60c52a844669b542","https://git.kernel.org/stable/c/ec0f1b3da8061be3173d1c39faaf9504f91942c3","https://git.kernel.org/stable/c/3ef3d52a1a9860d094395c7a3e593f3aa26ff012"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23069","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-23069","identifiers":["CVE-2026-23069"]},"retained":false,"historicalAffected":[]}],"coverage":[]}