CVE-2026-64115
Received Received - Intake

Use-After-Free in Linux Kernel vsock/vmci Connection Handling

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpected packet type (err = -EINVAL). All destroy: arms now return err < 0, so vmci_transport_recv_listen() removes pending from pending_links synchronously and vsock_pending_work() takes the is_pending=false / !rejected branch, dropping only its own work reference. This also closes the multi-packet race Sashiko reported on v2: pending is removed from the list before any subsequent packet can find it. The pre-existing sk_acceptq_removed() gap on the err < 0 path of vmci_transport_recv_listen() that Sashiko also noted is not introduced or changed by this patch. Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64115
EUVD
EUVD-2026-45800

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free (UAF) issue in the vsock/vmci module. When a peer resets a connection during the handshake process, the kernel incorrectly returns an error code of 0 instead of -EINVAL. This causes the pending socket to remain on the listener's list while its reference count drops to zero, leading to a double-free scenario where the socket is freed prematurely and then accessed again, causing a kernel crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's vsock/vmci module and may not have direct network detection methods. Monitor kernel logs for KASAN slab-use-after-free errors or crashes in vsock-related processes. Check for unexpected socket states or connection resets during handshake phases.

Impact Analysis

This vulnerability can cause system instability, including kernel panics or crashes, due to the use-after-free condition. It may lead to denial-of-service (DoS) attacks where an attacker triggers the flaw to crash the system. Systems using virtual machine communication interfaces (VMCI) or vsock for inter-process communication are particularly affected.

Compliance Impact

This vulnerability is a use-after-free (UAF) flaw in the Linux kernel's vsock/vmci module that could lead to memory corruption and potential arbitrary code execution. While not directly tied to data protection standards like GDPR or HIPAA, such vulnerabilities could indirectly impact compliance by enabling unauthorized access to sensitive data or system compromise if exploited.

Mitigation Strategies

Apply the kernel patch described in the CVE. Update your Linux kernel to a patched version (e.g., lts-6.12.79 or later). Restart affected services or systems to ensure the updated kernel is active.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart