The Linux kernel vulnerability CVE-2026-52994 concerns the vsock/virtio subsystem's handling of MSG_ZEROCOPY pinned-pages accounting. The function virtio_transport_init_zcopy_skb() incorrectly uses iter->count as the size argument for msg_zerocopy_realloc(), which is then passed to mm_account_pinned_pages() for RLIMIT_MEMLOCK enforcement. Because the iterator is consumed earlier by virtio_transport_fill_skb(), iter->count becomes zero on the last socket buffer, causing RLIMIT_MEMLOCK enforcement to be skipped. The fix involves passing pkt_len, the total bytes being sent, explicitly to virtio_transport_init_zcopy_skb(), matching the approach used by TCP and UDP. Multiple Linux kernel versions prior to 7.0.0-28.28 and related builds are affected. The vulnerability has been patched in updated kernel packages provided by Ubuntu, requiring system reboot and module recompilation.

The vulnerability allows bypassing RLIMIT_MEMLOCK enforcement in the vsock/virtio subsystem, which could lead to improper memory accounting of pinned pages. The CVSS vector indicates local attack vector with low privileges required and no user interaction, resulting in no confidentiality or integrity impact but a high impact on availability. This suggests potential denial of service or system instability. No known exploits are reported in the wild.

A patch is available and included in updated Linux kernel packages for affected Ubuntu releases. Users should apply the standard system update and reboot their systems to apply the fix. Due to an ABI change, recompilation and reinstallation of all third-party kernel modules are required after updating. Follow vendor instructions for updating to the specified package versions to remediate the vulnerability.