CVE-2026-53365PoC(linux / linux_kernel)

MEDIUMCVSS 5.5 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch linux linux_kernel systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb sends When a large message is fragmented into multiple skbs, the zerocopy uarg is only allocated and attached to the last skb in the loop. Non-final skbs carry pinned user pages with no completion tracking, so the kernel has no way to notify userspace when those pages are safe to reuse. If the loop breaks early the uarg is never allocated at all, leaking pinned pages with no completion notification. Fix this by following the approach used by TCP: allocate the zerocopy uarg (if not provided by the caller) before the send loop and attach it to every skb via skb_zcopy_set(), which takes a reference per skb. Each skb's completion properly decrements the refcount, and the notification only fires after the last skb is freed. On failure, if no data was sent, the uarg is cleanly aborted via net_zcopy_put_abort(). This issue was initially discovered by sashiko while reviewing commit 1cb36e252211 ("vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting") but was pre-existing.

linux CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Patch / fix

Other references

Weakness type (CWE)

CWE-401CWE-404

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

linux_kernel

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
15 mentions across 7 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 7 signals
PoC mentioned or linked in 9 signals
Patch or workaround mentioned in 9 signals
Technical details provided in 11 signals
Disclosure: 1 classified signal
Peaked 1d ago at 5 mentions (2026-08-25); latest day: 1
15 total mentions across 7 days

Affected systems

Vendors

linux

Products

linux_kernel

1 version affected across 1 product

Deep dive

Activity timeline15 mentions / 7d

Signal classification4 categories

PoC

853.3%

Patch

533.3%

Disclosure

16.7%

Exploit

16.7%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-13	2	Disclosure1Patch1
2026-08-14	4	Exploit1Patch1PoC2
2026-08-15	1	PoC1
2026-08-18	1	PoC1
2026-08-21	1	Patch1
2026-08-25	5	Patch1PoC4
2026-08-26	1	Patch1

Full discourse15 posts

yousukezan@yousukezan49d
PoC
LinuxカーネルのAF_VSOCKを悪用し、一般ユーザーがroot権限へ昇格できる脆弱性「CVE-2026-53365」のPoC「VsockDrop」が公開された。ユーザー名前空間やカーネル固有オフセットを必要とせず、単一の静的バイナリで動作する。問題はio_uringのゼロコピー送信経路にあり、メッセージが複数のsocket bufferへ分割される際、固定ページの参照管理を誤る。完了処理が本来触れるべきでないページにput_page()を実行し、送信ごとにpin countを1ずつ減らして固定中のページを解放できるという。 VsockDropは解放済みページを/usr/bin/suのpage cacheとして再利用し、program interpreter文字列を書き換える。その後setuid付きsuを実行すると、攻撃者のローダーがroot権限で起動する。カーネルコード実行や情報漏えいは使わない。影響範囲はLinux 6.7から7.0.10で、7.0.11で修正された。PoCはUbuntu、Debian、Arch、openSUSEでテスト済みで、実悪用は確認されていない。 https://securityonline.info/cve-2026-53365-vsockdrop-lpe/
Post summary
A PoC, VsockDrop, for CVE-2026-53365 has been released, showcasing root privilege escalation via AF_VSOCK on Linux 6.7–7.0.10. The issue is patched in 7.0.11 and no real-world exploitation has been observed.
07128103.9K
16.0K followersView on X
ThreatWire@ThreatWire_59d
PoC
🚨 PoC RELEASED: CVE-2026-53365 is a Linux kernel vsock/virtio flaw involving zerocopy page-reference corruption. The bug can trigger a use-after-free and leaked pinned pages. A public PoC, vsockdrop, reportedly turns the flaw into a local root exploit on multiple Linux distributions. The issue was introduced years ago, but its security impact became exploitable after later kernel changes. 🔗 https://github.com/maherazzouzi/vsockdrop #Linux #Kernel #CVE #PoC #LPE #CyberSecurity #Infosec
Post summary
A public PoC has been released for CVE‑2026‑53365, providing exploit code (vsockdrop) that can achieve local root on several Linux distributions. The post details the technical nature of the flaw but does not mention active exploitation or mitigation.
15025131.6K
1.7K followersView on X
Rıdvan Yağlı@ridvanyagli59d
PoC
🔴 Linux Kernel'de unprivileged LPE: VsockDrop Bir güvenlik araştırmacısı, Linux kernel'deki "io_uring" + "AF_VSOCK" zerocopy yolundaki CVE-2026-53365 açığından yararlanan bir Local Privilege Escalation (LPE) exploit'i yayınladı. Exploit, user namespace gerektirmeden normal bir kullanıcı hesabından root yetkisine yükselmeyi mümkün kılıyor. Etkilenen sürümler: Linux 6.7 -> 7.0.10 Düzeltme: Linux 7.0.11 Kanıt, Ubuntu 26.04 LTS üzerinde bare-metal sistemde gösteriliyor. PoC: https://github.com/MaherAzzouzi/vsockdrop
Post summary
A security researcher released an unprivileged Local Privilege Escalation PoC for CVE-2026-53365, exploiting io_uring and AF_VSOCK zerocopy in Linux kernels 6.7 to 7.0.10, with a patch available in version 7.0.11 and a GitHub repository providing the exploit code.
00024171.8K
2.4K followersView on X
kokumօtօ@__kokumoto49d
PoC
Linuxカーネルのローカル権限昇格脆弱性CVE-2026-53365に対応するPoC（攻撃の概念実証コード）"VsockDrop"が公表された。AF_VSOCKソケットを開ける以外の前提条件なし。kernel 6.7から7.0.10が脆弱。7.0.11/6.18.34/7.1で修正。 https://securityonline.info/cve-2026-53365-vsockdrop-lpe/
Post summary
A proof‑of‑concept named VsockDrop for CVE‑2026‑53365, a local privilege‑escalation flaw in Linux kernel 6.7‑7.0.10, has been published, and patches are available from kernel 7.0.11, 6.18.34, and 7.1.
0512081.7K
7.8K followersView on X
dbugs@ptdbugs60d
PoC
A PoC/exploit has been discovered for vulnerability CVE-2026-53365 Vendor: Linux Product: Linux kernel Description: A flaw exists in the vsock/virtio component regarding zerocopy completion for multi-skb sends. When a large message is fragmented into multiple skbs (socket buffers), the zerocopy uarg is only attached to the final skb. Consequently, non-final skbs contain pinned user pages without completion tracking, preventing the kernel from notifying userspace when these pages can be reused. If the send loop terminates prematurely, the uarg is not allocated, leading to a leak of pinned pages. This is resolved by allocating the uarg before the send loop and attaching it to every skb using the skb zcopy set() function. Link: https://github.com/maherazzouzi/vsockdrop #dbugs_vuln
Post summary
A PoC exploit for CVE-2026-53365, targeting the Linux kernel versus/virtio zero‑copy vulnerability, has been released on GitHub, though no active exploitation or patch is mentioned.
0112472.2K
3.6K followersView on X
Hack32@Hack32_59d
Exploit
Set up a testing laboratory; CVE-2026-53365: Privilege escalation in Linux kernel 6.8.0 (Ubuntu 22.04) exploited with vsockdrop 🐧💥 #Cybersecurity #Infosec #Exploit https://github.com/MaherAzzouzi/vsockdrop https://t.co/Lu5PRHBfJq
Post summary
The post announces CVE‑2026‑53365, a privilege escalation flaw in the Linux kernel, and shares a functional exploit (vsockdrop) via a GitHub link, but makes no claims of active exploitation or a patch.
000122535
827 followersView on X
Brad Spengler@spendergrsec59d
Patch
https://ubuntu.com/security/CVE-2026-53365
Post summary
The Ubuntu advisory for CVE‑2026‑53365 discloses a kernel vulnerability, provides technical details, and announces that a patch is available through standard package updates.
10051563
7.1K followersView on X
Daily CyberSecurity@Daily_CyberSec49d
PoC
A public PoC named VsockDrop turns CVE-2026-53365 into unprivileged local privilege escalation to root on Linux. Details and exploit code are disclosed. #CVE202653365 #VsockDrop #LinuxKernel #PrivilegeEscalation #vsock #LPE https://securityonline.info/cve-2026-53365-vsockdrop-lpe/
Post summary
The text announces that a publicly available Proof of Concept, VsockDrop, has been released for CVE‑2026‑53365, providing exploit code for a local privilege escalation on Linux.
01050533
13.0K followersView on X
OS開発者@hacker_infra49d
Patch
https://access.redhat.com/security/cve/cve-2026-53365 既にRHELは修正パッケージを公開ずみ RHEL7はまだ未公開。RHEL6は3.8から公式にマージされているのでバックポートされていないだろうね。 IPC間のファイルに関するものだから、緩和策はない。エクスプロイトをみてみたが、ヘッダーファイルが不足していて簡単にビルドできんだろうな。ビルドしたバイナリーをもってきたとしてもちゃんとうごくかどうかKASLRがあるんでむずかしいかな。
Post summary
Red Hat has published a patch for CVE‑2026‑53365; RHEL7 remains unpatched while the vulnerability involves IPC file handling with no mitigations.
00020654
2.9K followersView on X
Rıdvan Yağlı@ridvanyagli52d
Patch
👉 RtabRace (CVE-2026-68138) ve VsockDrop (CVE-2026-53365) Linux kernel açıkları için AlmaLinux, Ubuntu ve CloudLinux tarafında güvenlik güncellemeleri ve/veya mitigasyon çalışmaları yayınlanmaya başladı. Kernelinizi güncellemeyi veya mitigation uygulamayı unutmayın.
Post summary
The text announces that security updates and mitigations for CVE-2026-68138 and CVE-2026-53365 are available for AlmaLinux, Ubuntu, and CloudLinux, urging users to apply them; no PoC, exploit, or active exploitation is mentioned.
01010434
2.4K followersView on X
TuxCare@TuxCare_55d
PoC
🚨 VsockDrop (CVE-2026-53365) can let an unprivileged local Linux user escalate to root. A public PoC is available, and we reproduced it on Ubuntu 24.04 with no config changes. 👇 Check affected systems, mitigations, and patching: https://tuxcare.com/blog/cve-vsockdrop/?utm_source=twitter&utm_medium=social&utm_campaign=cve-alert https://t.co/05WIzgbrGL
Post summary
VsockDrop (CVE‑2026‑53365) allows unprivileged local Linux users to gain root; a public PoC is released and a patch is available via the linked article.
0001194
1.2K followersView on X
moton@moton49d
PoC
CVE-2026-53365: VsockDrop Root PoC Disclosed - https://securityonline.info/cve-2026-53365-vsockdrop-lpe/
Post summary
A root privilege proof‑of‑concept for CVE‑2026‑53365 has been disclosed and is linked for further details.
0000170
753 followersView on X
Yukiharu YABUKI🍥@YukiharuYABUKI48d
Patch
Debianは対応済みだけど、パッケージ更新してリブートしてるかは確認してくれよな。 https://osv.dev/vulnerability/DEBIAN-CVE-2026-53365
Post summary
Debian has already applied a patch for CVE‑2026‑53365; users should ensure they have the latest package updates and a system reboot to secure their environment.
00000138
768 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-53365 Linux Kernel Vsock/Virtio Zerocopy Completion Vulnerability for Multi-skb Sends https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-53365
Post summary
The text announces CVE-2026-53365—a Linux Kernel Vsock/Virtio Zerocopy Completion vulnerability for multi‑skb sends—without providing PoC, exploit code, active use, patch information, or detailed technical data.
00000107
4.1K followersView on X
Israel@f1tym191d
Patch
CVE-2026-53365 fixed a zerocopy completion flaw in Linux kernel, allowing attackers to leak pinned pages; fixed in 7․0․11, 7․1, 6․7, 6․18․34 https://ift.tt/woj7fJ2
Post summary
CVE-2026-53365 is a Linux kernel zerocopy completion flaw that leaks pinned pages; the vulnerability has been patched in kernel versions 7.0.11, 7.1, 6.7, and 6.18.34.
0000060
1.0K followersView on X

CPE platform detail5 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

5 of 5 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	linux	linux_kernel	-	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-
OS	linux	linux_kernel	7.1	-	-

Explore more

Back to dashboard linux CVEs linux_kernel vulnerabilities

What researchers are saying

CVE-2026-53365

yousukezan[verified]@yousukezanPoC

A PoC, VsockDrop, for CVE-2026-53365 has been released, showcasing root privilege escalation via AF_VSOCK on Linux 6.7–7.0.10. The issue is patched in 7.0.11 and no real-world exploitation has been observed.

ThreatWire[verified]@ThreatWire_PoC

A public PoC has been released for CVE‑2026‑53365, providing exploit code (vsockdrop) that can achieve local root on several Linux distributions. The post details the technical nature of the flaw but does not mention active exploitation or mitigation.

Rıdvan Yağlı[verified]@ridvanyagliPoC

A security researcher released an unprivileged Local Privilege Escalation PoC for CVE-2026-53365, exploiting io_uring and AF_VSOCK zerocopy in Linux kernels 6.7 to 7.0.10, with a patch available in version 7.0.11 and a GitHub repository providing the exploit code.

kokumօtօ[verified]@__kokumotoPoC

A proof‑of‑concept named VsockDrop for CVE‑2026‑53365, a local privilege‑escalation flaw in Linux kernel 6.7‑7.0.10, has been published, and patches are available from kernel 7.0.11, 6.18.34, and 7.1.

dbugs[verified]@ptdbugsPoC

A PoC exploit for CVE-2026-53365, targeting the Linux kernel versus/virtio zero‑copy vulnerability, has been released on GitHub, though no active exploitation or patch is mentioned.

OS開発者[verified]@hacker_infraPatch

Red Hat has published a patch for CVE‑2026‑53365; RHEL7 remains unpatched while the vulnerability involves IPC file handling with no mitigations.

Rıdvan Yağlı[verified]@ridvanyagliPatch

The text announces that security updates and mitigations for CVE-2026-68138 and CVE-2026-53365 are available for AlmaLinux, Ubuntu, and CloudLinux, urging users to apply them; no PoC, exploit, or active exploitation is mentioned.

Israel[verified]@f1tym1Patch

CVE-2026-53365 is a Linux kernel zerocopy completion flaw that leaks pinned pages; the vulnerability has been patched in kernel versions 7.0.11, 7.1, 6.7, and 6.18.34.