CVE-2026-80932

Status: UPDATED  |  Advisory ID: CVE-2026-80932

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: flush works in dependency order

virtio_vsock_remove() stops the virtqueues and then flushes each work

item before freeing the enclosing virtio_vsock. The current order does

not account for dependencies between those items: tx_work may queue

send_pkt_work, and send_pkt_work may queue rx_work.

In particular, send_pkt_work can set restart_rx and release tx_lock.

The remove path can then stop the queues and flush rx_work before

send_pkt_work queues it. Although the later send_pkt_work flush waits

for that producer to finish, nothing waits for the newly queued rx_work,

so kfree(vsock) can race with it.

KASAN reported:

BUG: KASAN: slab-use-after-free in

virtio_transport_rx_work+0x487/0x4b0

Read of size 8 at addr ffff888114c2b008 by task kworker/1:1/47

Workqueue: virtio_vsock virtio_transport_rx_work

Call Trace:

virtio_transport_rx_work+0x487/0x4b0

process_one_work+0x688/0x1120

worker_thread+0x45b/0xd10

Allocated by task 1:

virtio_vsock_probe+0xef/0x6b0

Freed by task 84:

kfree+0x131/0x3c0

virtio_vsock_remove+0xd1/0x100

Flush the works in producer-to-consumer order. virtio_vsock_vqs_del()

has already disabled the queue callbacks and cleared the run flags, so

after tx_work and send_pkt_work are drained, no source remains that can

queue rx_work after its flush. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References