The Linux kernel has a resource management flaw in the vsock/VMCI subsystem: when a handshake fails, the sk_ack_backlog counter is not decremented, thereby permanently inflating the backlog. As each failed handshake increments sk_ack_backlog, repeated failures eventually saturate the backlog limit, after which the listener refuses all new connection attempts with a silent ECONNREFUSED error. This denial of service can persist until the system is rebooted or the kernel process is restarted, and it does not affect any user data directly.

Linux kernels containing the vsock/VMCI implementation before the patch – any deployment that has not applied the recent kernel update that balances sk_acceptq_added and sk_acceptq_removed will be vulnerable.

An attacker who can generate malformed vsock packets or otherwise force handshake failures – from a guest VM, a privileged process, or network traffic – can gradually drive sk_ack_backlog to its maximum. Because the backlog counter is never reset automatically, the resulting denial of service is irreversible until a reboot. The EPSS score is unavailable, the CVSS score is not disclosed, and the flaw is not listed in the CISA KEV catalog; thus, exploitation is less likely to be observed but the impact is severe if achieved.