CVE-2026-64115

CVE CVE-2026-64115EUVD EUVD-2026-45800Published 2026-07-19T15:40:15.000ZLast changed 2026-08-05T12:39:24.000ZCVSS 8.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpected packet type (err = -EINVAL). All destroy: arms now return err < 0, so vmci_transport_recv_listen() removes pending from pending_links synchronously and vsock_pending_work() takes the is_pending=false / !rejected branch, dropping only its own work reference. This also closes the multi-packet race Sashiko reported on v2: pending is removed from the list before any subsequent packet can find it. The pre-existing sk_acceptq_removed() gap on the err < 0 path of vmci_transport_recv_listen() that Sashiko also noted is not introduced or changed by this patch. Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux d021c344051af91f42c5ba9fdedc176740cbd238 <99e22ddf4edb63dc8382bc028af928056d3450cf; d021c344051af91f42c5ba9fdedc176740cbd238 <ecda37f8faab3220da199335e42564cb7a9ad145; patch: 0; d021c344051af91f42c5ba9fdedc176740cbd238 <9fe74e42914c851d68069713b7b917a9c33faf26; patch: 7.1; patch: 6.12.92; d021c344051af91f42c5ba9fdedc176740cbd238 <440447699c681e26ed58e9c309cad718270a18b4; patch: 7.0.11; patch: 6.18.34; patch: 6.1.175; patch: 6.6.142; 3.9; patch: 5.10.258; d021c344051af91f42c5ba9fdedc176740cbd238 <1e19f08552b90070ed18bafb1763c78297823af6; d021c344051af91f42c5ba9fdedc176740cbd238 <47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9; d021c344051af91f42c5ba9fdedc176740cbd238 <1dd531e28f61edd286edc486ab068f135b5ae1eb; patch: 5.15.209; d021c344051af91f42c5ba9fdedc176740cbd238 <cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.