{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-63970",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-63970"
  ],
  "published": "2026-07-19T14:56:29Z",
  "summary": "vsock/virtio: bind uarg before filling zerocopy skb",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: bind uarg before filling zerocopy skb\n\nvirtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg\nbefore entering the send loop, but virtio_transport_alloc_skb() still\nfills the skb before it inherits that uarg. When fixed-buffer vectored\nzerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach\nmanaged frags and return -EMSGSIZE. The rollback path call kfree_skb()\nto free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so\nskb_release_data() falls through to ordinary frag unref.\n\nPass the uarg into virtio_transport_alloc_skb() and bind it immediately\nbefore virtio_transport_fill_skb(). This keeps control or no-payload skbs\nuntouched while ensuring success and rollback share one lifetime rule.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.12.20-1+rpt1~bpo12+1",
        "1:6.12.25-1+rpt1",
        "1:6.12.34-1+rpt1~bookworm",
        "1:6.12.47-1+rpt1~bookworm",
        "1:6.12.62-1+rpt1~bookworm",
        "1:6.12.75-1+rpt1~bookworm",
        "1:6.12.87-1+rpt1~bookworm",
        "1:6.12.93-1+rpt1",
        "1:6.12.96-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.12.20+rpt-rpi-2712",
            "binary_version": "1:6.12.20-1+rpt1~bpo12+1"
          },
          {
            "binary_name": "linux-image-6.12.20+rpt-rpi-v8",
            "binary_version": "1:6.12.20-1+rpt1~bpo12+1"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-2712",
            "binary_version": "1:6.12.25-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-v8",
            "binary_version": "1:6.12.25-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.34+rpt-rpi-2712",
            "binary_version": "1:6.12.34-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.34+rpt-rpi-v8",
            "binary_version": "1:6.12.34-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.34+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.34-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-2712",
            "binary_version": "1:6.12.47-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v8",
            "binary_version": "1:6.12.47-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.47-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.62+rpt-rpi-2712",
            "binary_version": "1:6.12.62-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.62+rpt-rpi-v8",
            "binary_version": "1:6.12.62-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.62+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.62-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.75+rpt-rpi-2712",
            "binary_version": "1:6.12.75-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.75+rpt-rpi-v8",
            "binary_version": "1:6.12.75-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.75+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.75-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.87+rpt-rpi-2712",
            "binary_version": "1:6.12.87-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.87+rpt-rpi-v8",
            "binary_version": "1:6.12.87-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.87+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.87-1+rpt1~bookworm"
          },
          {
            "binary_name": "linux-image-6.12.93+rpt-rpi-2712",
            "binary_version": "1:6.12.93-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.93+rpt-rpi-v8",
            "binary_version": "1:6.12.93-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.93+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.93-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.96+rpt-rpi-2712",
            "binary_version": "1:6.12.96-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.96+rpt-rpi-v8",
            "binary_version": "1:6.12.96-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.96+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.96-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.12.20-1+rpt1~bpo12+1": {
            "linux_commit": "cd231d4775b14f228606c09f219b48308f6ab3aa",
            "upstream_version": "6.12.20",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.25-1+rpt1": {
            "linux_commit": "3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16",
            "upstream_version": "6.12.25",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.34-1+rpt1~bookworm": {
            "linux_commit": "8f77e03530f65209a377d25023e912b288e039cd",
            "upstream_version": "6.12.34",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.47-1+rpt1~bookworm": {
            "linux_commit": "359f37f0faefb712add32a39f98751aea67d5c1f",
            "upstream_version": "6.12.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.62-1+rpt1~bookworm": {
            "linux_commit": "a1073743767f9e7fdc7017ababd2a07ea0c97c1c",
            "upstream_version": "6.12.62",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.75-1+rpt1~bookworm": {
            "linux_commit": "89050b1059997d38d55462b323b099a6436dc10d",
            "upstream_version": "6.12.75",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.87-1+rpt1~bookworm": {
            "linux_commit": "ae4d75fb36deba0fe1a986d9bfae65755e082dd0",
            "upstream_version": "6.12.87",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.93-1+rpt1": {
            "linux_commit": "d8ab4e908235da7727f22dd36ad5af224671677d",
            "upstream_version": "6.12.93",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.96-1+rpt1": {
            "linux_commit": "ae161617d7a4552fa91d03626b8d9f3696d17481",
            "upstream_version": "6.12.96",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          }
        }
      }
    },
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:13",
        "name": "linux"
      },
      "versions": [
        "1:6.12.19-1+rpt1~bpo12+1",
        "1:6.12.19-1+rpt1",
        "1:6.12.20-1+rpt1",
        "1:6.12.25-1+rpt1+trixie",
        "1:6.12.34-1+rpt1",
        "1:6.12.47-1+rpt1",
        "1:6.12.62-1+rpt1",
        "1:6.12.75-1+rpt1",
        "1:6.18.29-1+rpt1",
        "1:6.18.33-1+rpt1",
        "1:6.18.34-1+rpt1"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.12.19+rpt-rpi-2712",
            "binary_version": "1:6.12.19-1+rpt1~bpo12+1"
          },
          {
            "binary_name": "linux-image-6.12.19+rpt-rpi-v8",
            "binary_version": "1:6.12.19-1+rpt1~bpo12+1"
          },
          {
            "binary_name": "linux-image-6.12.19+rpt-rpi-2712",
            "binary_version": "1:6.12.19-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.19+rpt-rpi-v8",
            "binary_version": "1:6.12.19-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.20+rpt-rpi-2712",
            "binary_version": "1:6.12.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.20+rpt-rpi-v8",
            "binary_version": "1:6.12.20-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-2712",
            "binary_version": "1:6.12.25-1+rpt1+trixie"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-v8",
            "binary_version": "1:6.12.25-1+rpt1+trixie"
          },
          {
            "binary_name": "linux-image-6.12.25+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.25-1+rpt1+trixie"
          },
          {
            "binary_name": "linux-image-6.12.34+rpt-rpi-2712",
            "binary_version": "1:6.12.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.34+rpt-rpi-v8",
            "binary_version": "1:6.12.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.34+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-2712",
            "binary_version": "1:6.12.47-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v8",
            "binary_version": "1:6.12.47-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.47+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.47-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.62+rpt-rpi-2712",
            "binary_version": "1:6.12.62-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.62+rpt-rpi-v8",
            "binary_version": "1:6.12.62-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.62+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.62-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.75+rpt-rpi-2712",
            "binary_version": "1:6.12.75-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.75+rpt-rpi-v8",
            "binary_version": "1:6.12.75-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.12.75+rpt-rpi-v8-rt",
            "binary_version": "1:6.12.75-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.29+rpt-rpi-2712",
            "binary_version": "1:6.18.29-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.29+rpt-rpi-v8",
            "binary_version": "1:6.18.29-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt",
            "binary_version": "1:6.18.29-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-2712",
            "binary_version": "1:6.18.33-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-v8",
            "binary_version": "1:6.18.33-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt",
            "binary_version": "1:6.18.33-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-2712",
            "binary_version": "1:6.18.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-v8",
            "binary_version": "1:6.18.34-1+rpt1"
          },
          {
            "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt",
            "binary_version": "1:6.18.34-1+rpt1"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.12.19-1+rpt1~bpo12+1": {
            "linux_commit": "121c2c384b9c2f4790ffb31b2cd25c7d75c8fda0",
            "upstream_version": "6.12.19",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.19-1+rpt1": {
            "linux_commit": "121c2c384b9c2f4790ffb31b2cd25c7d75c8fda0",
            "upstream_version": "6.12.19",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.20-1+rpt1": {
            "linux_commit": "cd231d4775b14f228606c09f219b48308f6ab3aa",
            "upstream_version": "6.12.20",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.25-1+rpt1+trixie": {
            "linux_commit": "3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16",
            "upstream_version": "6.12.25",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.34-1+rpt1": {
            "linux_commit": "8f77e03530f65209a377d25023e912b288e039cd",
            "upstream_version": "6.12.34",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.47-1+rpt1": {
            "linux_commit": "359f37f0faefb712add32a39f98751aea67d5c1f",
            "upstream_version": "6.12.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.62-1+rpt1": {
            "linux_commit": "a1073743767f9e7fdc7017ababd2a07ea0c97c1c",
            "upstream_version": "6.12.62",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.12.75-1+rpt1": {
            "linux_commit": "89050b1059997d38d55462b323b099a6436dc10d",
            "upstream_version": "6.12.75",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.12.97"
          },
          "1:6.18.29-1+rpt1": {
            "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc",
            "upstream_version": "6.18.29",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.18.35"
          },
          "1:6.18.33-1+rpt1": {
            "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412",
            "upstream_version": "6.18.33",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.18.35"
          },
          "1:6.18.34-1+rpt1": {
            "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af",
            "upstream_version": "6.18.34",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.18.35"
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63970"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/72194f65050958e4c8e069adb6c5d89ef81ca197"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5d317573f1d48e76cce5fb6250452b6e4102e0fb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1e584c304cfb94a759417130b1fc6d30b30c4cce"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T13:16:28Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The bug is reached only via local AF_VSOCK transmission (syscall/io_uring send on a connected virtio vsock socket), not by processing remote network packets. Per kernel CVSS guidance, vsock is Local.\nAC:L - An attacker fully controls the trigger: SO_ZEROCOPY, io_uring IORING_OP_SEND_ZC with IORING_RECVSEND_FIXED_BUF and a vectored iov exceeding MAX_SKB_FRAGS (17), causing io_sg_from_iter() to return -EMSGSIZE on a deterministic error rollback path.\nPR:L - Exploitation requires only an unprivileged local process that can open a vsock connection and use io_uring zerocopy send; no CAP_NET_ADMIN or real root is needed beyond ordinary local user access in a virtio-vsock environment (KVM/Firecracker/cloud microVMs).\nUI:N - No victim interaction is required; the attacker triggers the bug directly through their own socket send/io_uring operation.\nS:U - Impact is kernel memory corruption and privilege escalation within the same security domain where the send occurs (guest kernel or host kernel). It is not a cross-boundary VM escape on the receive path; the flaw is in the sender's local skb teardown.\nC:H - Incorrect __skb_frag_unref() on SKBFL_MANAGED_FRAG_REFS pages without a bound uarg corrupts refcount/lifetime of io_uring registered buffer pages, yielding use-after-free and arbitrary kernel memory read primitives.\nI:H - The refcount corruption is a memory-safety bug in kernel heap/page management that can be leveraged for arbitrary write and control-flow hijacking, not merely a bounded data change.\nA:H - The erroneous frag unref on managed zerocopy pages can cause immediate kernel oops/panic from refcount underflow or use-after-free during skb teardown, independent of full exploitation."
    }
  }
}