The Linux kernel’s virtio_transport_recv_pkt() function does not validate the source of packets for connected VSOCK sockets. If a socket is already in the established state, a packet that originates from an unrelated source can be matched by the fallback destination‑only lookup, causing the socket to transition to TCP_ESTABLISHED while the stored remote address remains unchanged. An attacker can then send arbitrary data that will be read by the victim process, enabling data injection or potential code execution. This flaw is an instance of improper source validation, represented by CWE‑20.

Any Linux kernel build that incorporates virtio VSOCK networking and has not applied the commit adding vsock_check_source() is vulnerable. The flaw was fixed in later kernel releases, but no specific affected version range is provided in the CNA data. Therefore, all kernels using the virtio transport prior to the patch should be considered at risk.

CVSS and EPSS scores are not available, and the vulnerability is not listed in the CISA KEV catalog. However, the flaw allows an attacker with access to the VSOCK network to hijack a socket and inject arbitrary payloads, which could lead to remote code execution if the victim application processes data unsafely. Discovery of the target socket requires only unprivileged AF_VSOCK sock_diag calls and knowledge of the victim’s CID and port, conditions that are realistically obtainable within a virtualized environment. These factors, combined with the absence of a validation check, make the vulnerability high risk and should prompt prompt remediation.