CVE-2026-64115

Status: UPDATED  |  Advisory ID: CVE-2026-64115

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

vsock/vmci: fix UAF when peer resets connection during handshake

vmci_transport_recv_connecting_server() returned err = 0 for a peer

RST in its default switch arm:

err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;

That made vmci_transport_recv_listen() skip vsock_remove_pending(),

leaving the pending socket on the listener's pending_links with

sk_state = TCP_CLOSE while destroy: still dropped the explicit

reference taken before schedule_delayed_work().

One second later vsock_pending_work() observed is_pending=true and

performed full cleanup: vsock_remove_pending() then the two trailing

sock_put(sk) calls -- the first reached refcount 0 and __sk_freed

the socket, and the second wrote into the freed object:

BUG: KASAN: slab-use-after-free in refcount_warn_saturate

Write of size 4 at addr ffff88800b1cac80 by task kworker

Workqueue: events vsock_pending_work

Treat peer RST like any other unexpected packet type (err = -EINVAL).

All destroy: arms now return err < 0, so vmci_transport_recv_listen()

removes pending from pending_links synchronously and

vsock_pending_work() takes the is_pending=false / !rejected branch,

dropping only its own work reference. This also closes the

multi-packet race Sashiko reported on v2: pending is removed from

the list before any subsequent packet can find it.

The pre-existing sk_acceptq_removed() gap on the err < 0 path of

vmci_transport_recv_listen() that Sashiko also noted is not

introduced or changed by this patch.

Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References