CVE-2026-74613

Received Received - Intake

Use-After-Free in Linux Kernel vsock/virtio

Publication date: 2026-08-22

Last updated on: 2026-08-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: avoid refilling the RX queue after teardown Commit b917507e5ad9 ("vsock/virtio: stop workers during the .remove()") made the RX worker jump to its common exit when rx_run is clear. That exit still refills the RX queue when the buffer count is low, so work queued across virtio_vsock_vqs_del() can add buffers after the virtqueues have been deleted. BUG: KASAN: slab-use-after-free in virtqueue_add_sgs Read of size 4 by task kworker/0:1 Workqueue: virtio_vsock virtio_transport_rx_work Call Trace: virtqueue_add_sgs (drivers/virtio/virtio_ring.c:2796) virtio_vsock_rx_fill (net/vmw_vsock/virtio_transport.c:332) virtio_transport_rx_work (net/vmw_vsock/virtio_transport.c:701) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) ... Freed by task 141: kfree (mm/slub.c:6566) vp_del_vq (drivers/virtio/virtio_pci_common.c:259) vp_del_vqs (drivers/virtio/virtio_pci_common.c:285) virtio_vsock_freeze (net/vmw_vsock/virtio_transport.c:912) virtio_device_freeze (drivers/virtio/virtio.c:658) virtio_pci_freeze (drivers/virtio/virtio_pci_common.c:601) pci_pm_freeze (drivers/pci/pci-driver.c:1098) device_suspend (drivers/base/power/main.c:1968) Kernel panic - not syncing: KASAN: panic_on_warn set ... Jump to a no-refill exit when rx_run is clear, leaving the normal exit to replenish a running queue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-22

Last Modified

2026-08-25

Generated

2026-09-12

AI Q&A

2026-08-22

EPSS Evaluated

2026-09-10

NVD

CVE-2026-74613

EUVD

EUVD-2026-64550

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the vsock/virtio subsystem. When the RX worker thread exits due to rx_run being cleared, it may still attempt to refill the RX queue if buffer count is low. This can lead to operations on already-freed virtqueues, causing a slab-use-after-free error and potential kernel panic.

Detection Guidance

This vulnerability is specific to the Linux kernel's vsock/virtio implementation and may not have direct detection commands. Monitor kernel logs for KASAN slab-use-after-free errors related to virtqueue_add_sgs or virtio_vsock_rx_fill. Check for kernel panics or crashes during virtio device operations.

Impact Analysis

This vulnerability can cause system instability, including kernel crashes (kernel panic) and potential denial-of-service conditions. Systems using virtio-vsock for virtual machine communication may experience unexpected failures or require reboot.

Compliance Impact

This vulnerability is a kernel-level issue in the Linux vsock/virtio subsystem that could lead to a use-after-free condition, potentially causing system instability or crashes. While it does not directly impact data privacy or security controls, such kernel vulnerabilities may affect compliance by compromising system integrity, which is a foundational requirement for standards like GDPR and HIPAA.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for this issue. Specifically, ensure the commit b917507e5ad9 or later is included in your kernel version. Reboot the system after applying the patch to activate the changes.

Hi! I’m here to help you understand CVE-2026-74613. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70