CVE-2026-80932

Received Received - Intake

Use-After-Free in Linux Kernel vsock/virtio

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtio_vsock_remove() stops the virtqueues and then flushes each work item before freeing the enclosing virtio_vsock. The current order does not account for dependencies between those items: tx_work may queue send_pkt_work, and send_pkt_work may queue rx_work. In particular, send_pkt_work can set restart_rx and release tx_lock. The remove path can then stop the queues and flush rx_work before send_pkt_work queues it. Although the later send_pkt_work flush waits for that producer to finish, nothing waits for the newly queued rx_work, so kfree(vsock) can race with it. KASAN reported: BUG: KASAN: slab-use-after-free in virtio_transport_rx_work+0x487/0x4b0 Read of size 8 at addr ffff888114c2b008 by task kworker/1:1/47 Workqueue: virtio_vsock virtio_transport_rx_work Call Trace: virtio_transport_rx_work+0x487/0x4b0 process_one_work+0x688/0x1120 worker_thread+0x45b/0xd10 Allocated by task 1: virtio_vsock_probe+0xef/0x6b0 Freed by task 84: kfree+0x131/0x3c0 virtio_vsock_remove+0xd1/0x100 Flush the works in producer-to-consumer order. virtio_vsock_vqs_del() has already disabled the queue callbacks and cleared the run flags, so after tx_work and send_pkt_work are drained, no source remains that can queue rx_work after its flush.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80932

EUVD

EUVD-2026-76255

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's virtio-vsock subsystem. It occurs when the virtio_vsock_remove() function stops virtqueues and flushes work items without considering dependencies between them. Specifically, tx_work may queue send_pkt_work, which may queue rx_work. The improper flushing order allows rx_work to execute after the vsock structure is freed, leading to a race condition and potential memory corruption.

Detection Guidance

This vulnerability is specific to the Linux kernel's vsock/virtio implementation and may manifest as a slab-use-after-free error reported by KASAN. Detection typically requires kernel logging or KASAN output showing the described error pattern in virtio_transport_rx_work or related functions.

Impact Analysis

This vulnerability could cause system crashes, data corruption, or privilege escalation if exploited. It may lead to kernel memory corruption, allowing attackers to execute arbitrary code or cause denial-of-service conditions on affected systems running vulnerable Linux kernel versions.

Mitigation Strategies

Apply the kernel patch that resolves this issue by ensuring work items are flushed in producer-to-consumer order. Update to a patched kernel version where virtio_vsock_remove properly handles work queue dependencies.

Hi! I’m here to help you understand CVE-2026-80932. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70