In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in read_skb() After a partial stream… (CVE-2026-99062)

The vulnerability in the Linux kernel's vsock/virtio code involved improper accounting of unread bytes in the read_skb() function. After a partial stream receive, the rx_bytes counter tracked only the unread suffix, while buf_used and peer credit counters still covered the entire packet length. The function virtio_transport_read_skb() dequeued the packet but incorrectly passed the full packet length for both counters, causing rx_bytes to underflow. This led to erroneous socket status reports such as negative byte counts, empty receive returns, and misleading poll results. The fix adjusts rx_bytes to subtract only the skb->len minus the VSOCK offset, maintaining balanced counters and ensuring all queued data is exposed immediately.

The vulnerability caused incorrect socket receive queue accounting, which could result in negative byte counts reported by SIOCINQ, empty receive returns (ELOOP), and misleading poll notifications indicating data availability when none was present. This could disrupt applications relying on accurate socket state information, potentially leading to logic errors or stalled data processing. There is no indication of code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to correct the accounting logic in the vsock/virtio read_skb() function. Users should update to the patched kernel versions once available. Since this is a kernel-level fix, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory for current remediation guidance.