CVE-2026-64115 - Vulnerability Details

- vsock/vmci: fix UAF when peer resets connection during handshake

Description

In the Linux kernel, the following vulnerability has been resolved:

vsock/vmci: fix UAF when peer resets connection during handshake

vmci_transport_recv_connecting_server() returned err = 0 for a peer
RST in its default switch arm:

err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;

That made vmci_transport_recv_listen() skip vsock_remove_pending(),
leaving the pending socket on the listener's pending_links with
sk_state = TCP_CLOSE while destroy: still dropped the explicit
reference taken before schedule_delayed_work().

One second later vsock_pending_work() observed is_pending=true and
performed full cleanup: vsock_remove_pending() then the two trailing
sock_put(sk) calls -- the first reached refcount 0 and __sk_freed
the socket, and the second wrote into the freed object:

BUG: KASAN: slab-use-after-free in refcount_warn_saturate
Write of size 4 at addr ffff88800b1cac80 by task kworker
Workqueue: events vsock_pending_work

Treat peer RST like any other unexpected packet type (err = -EINVAL).
All destroy: arms now return err < 0, so vmci_transport_recv_listen()
removes pending from pending_links synchronously and
vsock_pending_work() takes the is_pending=false / !rejected branch,
dropping only its own work reference. This also closes the
multi-packet race Sashiko reported on v2: pending is removed from
the list before any subsequent packet can find it.

The pre-existing sk_acceptq_removed() gap on the err < 0 path of
vmci_transport_recv_listen() that Sashiko also noted is not
introduced or changed by this patch.

Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.

Published: 2026-07-19

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel’s vsock/vmci transport layer causes a use‑after‑free when a peer sends a reset packet during the connection handshake. The code incorrectly treats this packet as a normal error, leaving a reference to a pending socket that is later freed. Subsequent cleanup logic writes to the already‑freed memory, triggering a kernel memory corruption that can damage kernel data structures.

Affected Systems

All Linux kernel installations that have not applied the recent vsock/vmci fix are affected. The vulnerability was merged into mainline and is available in the 6.12 LTS series beginning with revision 6.12.79; kernel releases prior to that revision, including the 7.1 release candidates listed in the CPE data, remain vulnerable unless the patch is applied.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or virtual machine access that can send a reset packet on a vsock connection; this inference is based on the bug’s requirement for interaction with the vsock/vmci transport layer. Exploitation would involve provoking the use‑after‑free to corrupt kernel memory, with potential impact on kernel integrity and system stability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d021c344051af91f42c5ba9fdedc176740cbd238`	affected	< 1e19f08552b90070ed18bafb1763c78297823af6
`d021c344051af91f42c5ba9fdedc176740cbd238`	affected	< 1dd531e28f61edd286edc486ab068f135b5ae1eb
`d021c344051af91f42c5ba9fdedc176740cbd238`	affected	< ecda37f8faab3220da199335e42564cb7a9ad145
`d021c344051af91f42c5ba9fdedc176740cbd238`	affected	< cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb
`d021c344051af91f42c5ba9fdedc176740cbd238`	affected	< 47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9
`d021c344051af91f42c5ba9fdedc176740cbd238`	affected	< 440447699c681e26ed58e9c309cad718270a18b4
`d021c344051af91f42c5ba9fdedc176740cbd238`	affected	< 9fe74e42914c851d68069713b7b917a9c33faf26
`d021c344051af91f42c5ba9fdedc176740cbd238`	affected	< 99e22ddf4edb63dc8382bc028af928056d3450cf

Linux

affected

Version	Status	Constraints
`3.9`	affected	—
`0`	unaffected	< 3.9
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[d021c344051af91f42c5ba9fdedc176740cbd238,1e19f08552b90070ed18bafb1763c78297823af6)`	affected	code_commit	—
`[d021c344051af91f42c5ba9fdedc176740cbd238,1dd531e28f61edd286edc486ab068f135b5ae1eb)`	affected	code_commit	—
`[d021c344051af91f42c5ba9fdedc176740cbd238,ecda37f8faab3220da199335e42564cb7a9ad145)`	affected	code_commit	—
`[d021c344051af91f42c5ba9fdedc176740cbd238,cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb)`	affected	code_commit	—
`[d021c344051af91f42c5ba9fdedc176740cbd238,47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9)`	affected	code_commit	—
`[d021c344051af91f42c5ba9fdedc176740cbd238,440447699c681e26ed58e9c309cad718270a18b4)`	affected	code_commit	—
`[d021c344051af91f42c5ba9fdedc176740cbd238,9fe74e42914c851d68069713b7b917a9c33faf26)`	affected	code_commit	—
`[d021c344051af91f42c5ba9fdedc176740cbd238,99e22ddf4edb63dc8382bc028af928056d3450cf)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.9`	affected	semver	—
`[0,3.9)`	unaffected	semver	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to version 6.12.79 or later, which contains the vsock/vmci use‑after‑free fix.
If a kernel upgrade is not feasible, obtain the relevant patch from the provided commit references, apply the patch to the running kernel source tree, rebuild, and install the patched kernel.
Until the patch can be applied, restrict or block vsock (vmci) connections from untrusted parties by disabling the vsock module or configuring the virtualization host to refuse vmci traffic.

Generated by OpenCVE AI on August 13, 2026 at 12:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00135.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb
https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6
https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4
https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9
https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf
https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26
https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb
https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145
https://lore.kernel.org/linux-cve-announce/2026071923-CVE-2026-64115-de9e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64115
https://www.cve.org/CVERecord?id=CVE-2026-64115

History

Wed, 12 Aug 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}`

Mon, 20 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://lore.kernel.org/linux-cve-announce/2026071923-CVE-2026-64115-de9e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64115 https://www.cve.org/CVERecord?id=CVE-2026-64115
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpected packet type (err = -EINVAL). All destroy: arms now return err < 0, so vmci_transport_recv_listen() removes pending from pending_links synchronously and vsock_pending_work() takes the is_pending=false / !rejected branch, dropping only its own work reference. This also closes the multi-packet race Sashiko reported on v2: pending is removed from the list before any subsequent packet can find it. The pre-existing sk_acceptq_removed() gap on the err < 0 path of vmci_transport_recv_listen() that Sashiko also noted is not introduced or changed by this patch. Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.
Title		vsock/vmci: fix UAF when peer resets connection during handshake
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6 https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4 https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9 https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26 https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:40:15.513Z

Updated: 2026-08-05T12:39:24.360Z

Reserved: 2026-07-19T07:54:57.035Z

Link: CVE-2026-64115

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-19T16:17:52.967

Modified: 2026-08-12T15:50:13.127

Link: CVE-2026-64115

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64115 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T13:00:04Z

Weaknesses

CWE-416
Use After Free
CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object