Linux Kernel EUVD-2026-32841

The vulnerability resides in the AF_VSOCK (Virtual Socket) subsystem's virtio transport backend (vmw_vsock_virtio_transport kernel module), which facilitates socket-based communication between guest virtual machines and hypervisors. The root cause is an improper resource accounting pattern in virtio_transport_recv_listen(): the accept queue counter sk_ack_backlog is incremented via sk_acceptq_added() before vsock_assign_transport() is called to validate and select the appropriate transport. When vsock_assign_transport() fails - for example, due to a transport type mismatch where the connecting peer's transport does not match what the listener expects - the error path returns without invoking the paired sk_acceptq_removed() decrement. This is a resource counter leak analogous to CWE-459 (Incomplete Cleanup) or CWE-911 (Improper Update of Reference Count), though NVD lists CWE as N/A for this entry. The fix, mirroring the already-correct pattern in vmci_transport and hyperv_transport, moves sk_acceptq_added() to after successful transport validation. CPE data confirms the affected product as cpe:2.3:o:linux:linux_kernel across multiple stable branches.