CVE-2026-63970

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: bind uarg before filling zerocopy skb

virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg

before entering the send loop, but virtio_transport_alloc_skb() still

fills the skb before it inherits that uarg. When fixed-buffer vectored

zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach

managed frags and return -EMSGSIZE. The rollback path call kfree_skb()

to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so

skb_release_data() falls through to ordinary frag unref.

Pass the uarg into virtio_transport_alloc_skb() and bind it immediately

before virtio_transport_fill_skb(). This keeps control or no-payload skbs

untouched while ensuring success and rollback share one lifetime rule.