vsock/vmci: fix UAF when peer resets connection during handshake

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-64115
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 16:17:52 UTC
Updated2026-07-19 16:17:52 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpected packet type (err = -EINVAL). All destroy: arms now return err < 0, so vmci_transport_recv_listen() removes pending from pending_links synchronously and vsock_pending_work() takes the is_pending=false / !rejected branch, dropping only its own work reference. This also closes the multi-packet race Sashiko reported on v2: pending is removed from the list before any subsequent packet can find it. The pre-existing sk_acceptq_removed() gap on the err < 0 path of vmci_transport_recv_listen() that Sashiko also noted is not introduced or changed by this patch. Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected d021c344051af91f42c5ba9fdedc176740cbd238 1e19f08552b90070ed18bafb1763c78297823af6 git Not specified
CNA Linux Linux affected d021c344051af91f42c5ba9fdedc176740cbd238 1dd531e28f61edd286edc486ab068f135b5ae1eb git Not specified
CNA Linux Linux affected d021c344051af91f42c5ba9fdedc176740cbd238 ecda37f8faab3220da199335e42564cb7a9ad145 git Not specified
CNA Linux Linux affected d021c344051af91f42c5ba9fdedc176740cbd238 cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb git Not specified
CNA Linux Linux affected d021c344051af91f42c5ba9fdedc176740cbd238 47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9 git Not specified
CNA Linux Linux affected d021c344051af91f42c5ba9fdedc176740cbd238 440447699c681e26ed58e9c309cad718270a18b4 git Not specified
CNA Linux Linux affected d021c344051af91f42c5ba9fdedc176740cbd238 9fe74e42914c851d68069713b7b917a9c33faf26 git Not specified
CNA Linux Linux affected d021c344051af91f42c5ba9fdedc176740cbd238 99e22ddf4edb63dc8382bc028af928056d3450cf git Not specified
CNA Linux Linux affected 3.9 Not specified
CNA Linux Linux unaffected 3.9 semver Not specified
CNA Linux Linux unaffected 5.10.258 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.209 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.175 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.142 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.92 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.34 6.18.* semver Not specified
CNA Linux Linux unaffected 7.0.11 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report