CVE-2026-64115

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel vsock/vmci Connection Handling

Publication date: 2026-07-19

Last updated on: 2026-08-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpected packet type (err = -EINVAL). All destroy: arms now return err < 0, so vmci_transport_recv_listen() removes pending from pending_links synchronously and vsock_pending_work() takes the is_pending=false / !rejected branch, dropping only its own work reference. This also closes the multi-packet race Sashiko reported on v2: pending is removed from the list before any subsequent packet can find it. The pre-existing sk_acceptq_removed() gap on the err < 0 path of vmci_transport_recv_listen() that Sashiko also noted is not introduced or changed by this patch. Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-12

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64115

EUVD

EUVD-2026-45800

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)
linux	linux_kernel	From 3.9 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free (UAF) issue in the vsock/vmci module. When a peer resets a connection during the handshake process, the kernel incorrectly returns an error code of 0 instead of -EINVAL. This causes the pending socket to remain on the listener's list while its reference count drops to zero, leading to a double-free scenario where the socket is freed prematurely and then accessed again, causing a kernel crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's vsock/vmci module and may not have direct network detection methods. Monitor kernel logs for KASAN slab-use-after-free errors or crashes in vsock-related processes. Check for unexpected socket states or connection resets during handshake phases.

Impact Analysis

This vulnerability can cause system instability, including kernel panics or crashes, due to the use-after-free condition. It may lead to denial-of-service (DoS) attacks where an attacker triggers the flaw to crash the system. Systems using virtual machine communication interfaces (VMCI) or vsock for inter-process communication are particularly affected.

Compliance Impact

This vulnerability is a use-after-free (UAF) flaw in the Linux kernel's vsock/vmci module that could lead to memory corruption and potential arbitrary code execution. While not directly tied to data protection standards like GDPR or HIPAA, such vulnerabilities could indirectly impact compliance by enabling unauthorized access to sensitive data or system compromise if exploited.

Mitigation Strategies

Apply the kernel patch described in the CVE. Update your Linux kernel to a patched version (e.g., lts-6.12.79 or later). Restart affected services or systems to ensure the updated kernel is active.

Hi! I’m here to help you understand CVE-2026-64115. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70