EUVD-2026-64550
GHSA-3935-6jc6-r9rc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition timing between teardown and worker raises AC to H; PR:L since local low-privileged user can open vsock sockets.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: avoid refilling the RX queue after teardown
Commit b917507e5ad9 ("vsock/virtio: stop workers during the .remove()") made the RX worker jump to its common exit when rx_run is clear. That exit still refills the RX queue when the buffer count is low, so work queued across virtio_vsock_vqs_del() can add buffers after the virtqueues have been deleted.
BUG: KASAN: slab-use-after-free in virtqueue_add_sgs Read of size 4 by task kworker/0:1 Workqueue: virtio_vsock virtio_transport_rx_work Call Trace: virtqueue_add_sgs (drivers/virtio/virtio_ring.c:2796) virtio_vsock_rx_fill (net/vmw_vsock/virtio_transport.c:332) virtio_transport_rx_work (net/vmw_vsock/virtio_transport.c:701) process_one_work (kernel/workqueue.c:3314) worker_thread (kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) ... Freed by task 141: kfree (mm/slub.c:6566) vp_del_vq (drivers/virtio/virtio_pci_common.c:259) vp_del_vqs (drivers/virtio/virtio_pci_common.c:285) virtio_vsock_freeze (net/vmw_vsock/virtio_transport.c:912) virtio_device_freeze (drivers/virtio/virtio.c:658) virtio_pci_freeze (drivers/virtio/virtio_pci_common.c:601) pci_pm_freeze (drivers/pci/pci-driver.c:1098) device_suspend (drivers/base/power/main.c:1968) Kernel panic - not syncing: KASAN: panic_on_warn set ...
Jump to a no-refill exit when rx_run is clear, leaving the normal exit to replenish a running queue.
AnalysisAI
Use-after-free in the Linux kernel vsock/virtio RX worker allows a local low-privileged user to trigger memory corruption during device teardown, potentially achieving privilege escalation or kernel panic. The race condition exists because the RX worker's common exit path continues to refill the virtqueue even after rx_run is cleared and virtqueues have been deleted via virtio_vsock_vqs_del(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the vsock/virtio kernel module must be loaded (CONFIG_VIRTIO_VSOCKETS compiled in or loaded as a module), which is common in KVM/QEMU guests but not default on bare-metal hosts; (2) the attacker must have local access with at minimum low privileges sufficient to open AF_VSOCK sockets; (3) a concurrent device removal or system suspend/hibernate event must occur while the RX worker is active - this can be user-triggered (e.g., initiating suspend) or administratively scheduled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a locally exploitable kernel UAF requiring only low privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a local shell inside a KVM/QEMU guest where vsock is enabled initiates AF_VSOCK communication to keep the RX worker active, then simultaneously triggers device removal or system suspend. The RX worker races past the rx_run=false check, calls virtio_vsock_rx_fill(), and writes to the already-freed virtqueue structure, corrupting kernel heap memory. … |
| Remediation | The primary fix is to upgrade to a patched stable kernel version: 5.10.265+, 5.15.216+, 6.1.183+, 6.6.152+, 6.12.104+, 6.18.45+, 7.1.9+, or 7.2+. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit systems running Linux with vsock/virtio enabled, particularly containerized and virtual machine environments; document kernel versions and prioritize business-critical infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today