CVE-2026-99062: Linux kernel · vsock/virtio: account only unread bytes in read_skb()
Affects Linux kernelSource CVE Database V5
Mentioned vulnerabilities
Not known to be exploited · fixed in e4a0028b0d54b2c45e1dc8c0dd95fe3e9236f55b : update Linux kernel when convenient.
Data as of 26 Oct 2026, 14:18 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in e4a0028b0d54b2c45e1dc8c0dd95fe3e9236f55b, dd4b2f88ee517f9629d0d3dbfced02ffbc33e2dc, a463f55c791b96cfd12df8b10ea737d45c80bb18 +3
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available in Linux kernel versions 6.12.113 and later, 6.16, and corresponding commits identified by hashes e4a0028b0d54b2c45e1dc8c0dd95fe3e9236f55b, dd4b2f88ee517f9629d0d3dbfced02ffbc33e2dc, a463f55c791b96cfd12df8b10ea737d45c80bb18, and 38bad3930b1185dd6c98db3dd342ddc123c6f3ef. Users should upgrade to these fixed versions to resolve the issue. No alternative mitigations are indicated.
Description
A vulnerability in the Linux kernel's vsock/virtio subsystem caused incorrect accounting of unread bytes in the read_skb() function. This led to underflow of the rx_bytes counter after partial stream receives, causing socket state inconsistencies such as negative byte counts reported by SIOCINQ, empty reads returning ELOOP, and poll indicating readability on empty sockets. The issue was fixed by adjusting the accounting to subtract only the unread portion of the packet from rx_bytes, ensuring accurate tracking of queued data.
References
- git.kernel.org/stable/c/e4a0028b0d54b2c45e1dc8c0dd95fe3e9236f55b (opens in a new tab)
- git.kernel.org/stable/c/38bad3930b1185dd6c98db3dd342ddc123c6f3ef (opens in a new tab)
- git.kernel.org/stable/c/dd4b2f88ee517f9629d0d3dbfced02ffbc33e2dc (opens in a new tab)
- git.kernel.org/stable/c/a463f55c791b96cfd12df8b10ea737d45c80bb18 (opens in a new tab)