Executive Summary

This vulnerability exists in the Linux kernel's vsock/virtio subsystem. The issue arises because the function virtio_transport_recv_listen() calls sk_acceptq_added() before validating the transport with vsock_assign_transport(). If vsock_assign_transport() fails or selects a different transport, the error path returns without calling sk_acceptq_removed(), which causes the accept queue count (sk_ack_backlog) to be permanently incremented.

As a result, after approximately backlog+1 such failures, the accept queue becomes full (sk_acceptq_is_full() returns true), causing the listener to reject all new incoming connections. The fix involved moving the call to sk_acceptq_added() to after the transport validation to ensure the accept queue count is correctly managed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial of service condition where the listener in the vsock/virtio subsystem rejects all new incoming connections after a certain number of transport mismatches or failures. This happens because the accept queue count is leaked and eventually fills up, preventing new connections from being accepted.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by updating the Linux kernel to a version where the accept queue count leak on transport mismatch in vsock/virtio is resolved.

Specifically, the fix involves moving the sk_acceptq_added() call to after transport validation to prevent the accept queue count from leaking and causing the listener to reject new connections.

Therefore, the immediate mitigation step is to apply the kernel update that includes this fix.

Useful 0 Not Useful 0