The Linux kernel has a resource management flaw in the vsock/VMCI subsystem: when a handshake fails, the sk_ack_backlog counter is not decremented, thereby permanently inflating the backlog. As each failed handshake increments sk_ack_backlog, repeated failures eventually saturate the backlog limit, after which the listener refuses all new connection attempts with a silent ECONNREFUSED error. This denial of service can persist until the system is rebooted or the kernel process is restarted, and it does not affect any user data directly. This weakness is an instance of CWE-399 (Resource Exhaustion).

Linux kernels containing the vsock/VMCI implementation before the patch – any deployment that has not applied the recent kernel update that balances sk_acceptq_added and sk_acceptq_removed will be vulnerable.

It is inferred that an attacker who can generate malformed vsock packets or otherwise force handshake failures—such as from a guest VM, a privileged process, or external network traffic—can gradually drive sk_ack_backlog to its maximum. Because the backlog counter is never reset automatically, the resulting denial of service is irreversible until a reboot. The EPSS score is < 1%, the CVSS score is 7.0, and the flaw is not listed in the CISA KEV catalog; thus exploitation is less likely to be observed but the impact is severe if achieved.