The Linux kernel's vsock/virtio implementation had a vulnerability in the MSG_ZEROCOPY pinned-pages accounting mechanism. The function virtio_transport_init_zcopy_skb() used iter->count as the size argument for msg_zerocopy_realloc(), which then calls mm_account_pinned_pages() to enforce RLIMIT_MEMLOCK limits. However, iter->count was zero after the iterator was consumed by virtio_transport_fill_skb(), causing RLIMIT_MEMLOCK enforcement to be skipped on the last socket buffer. The fix passes pkt_len (the total bytes sent) explicitly to virtio_transport_init_zcopy_skb(), aligning with TCP and UDP implementations that use the original message size for accounting.

This vulnerability can lead to bypassing RLIMIT_MEMLOCK enforcement, potentially allowing excessive pinned memory usage. The CVSS vector indicates a local attack vector with low complexity and low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. This suggests the vulnerability could cause denial of service by exhausting memory locking resources.

A fix is available and should be applied by upgrading the Linux kernel to version 7.0.0-28.28.1 or later. Users should update their kernel packages to incorporate this patch to ensure proper RLIMIT_MEMLOCK enforcement in the vsock/virtio MSG_ZEROCOPY implementation.