In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake… (CVE-2026-64115)
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpected packet type (err = -EINVAL). All destroy: arms now return err < 0, so vmci_transport_recv_listen() removes pending from pending_links synchronously and vsock_pending_work() takes the is_pending=false / !rejected branch, dropping only its own work reference. This also closes the multi-packet race Sashiko reported on v2: pending is removed from the list before any subsequent packet can find it. The pre-existing sk_acceptq_removed() gap on the err < 0 path of vmci_transport_recv_listen() that Sashiko also noted is not introduced or changed by this patch. Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.
AI Analysis
Technical Summary
The Linux kernel's vsock/vmci transport code mishandled a peer reset (RST) packet during connection handshake. Specifically, vmci_transport_recv_connecting_server() returned 0 for a peer RST, causing vmci_transport_recv_listen() to skip removing the pending socket from the listener's pending_links list. This left the socket in TCP_CLOSE state but still referenced. Later, vsock_pending_work() performed cleanup including two sock_put() calls, where the first freed the socket and the second wrote to the freed memory, causing a use-after-free detected by KASAN. This vulnerability (CVE-2026-64115) allows local attackers with limited privileges to cause kernel memory corruption with potential impact on confidentiality, integrity, and availability. Ubuntu has released patches fixing this issue in multiple kernel versions.
Potential Impact
Exploitation of this vulnerability can lead to use-after-free conditions in kernel memory, potentially causing system crashes or allowing attackers to corrupt kernel memory. The CVSS 3.1 score is 8.8 (high severity), indicating significant impact on confidentiality, integrity, and availability. The vulnerability requires local privileges and low attack complexity but no user interaction. It affects systems running vulnerable Linux kernel versions, potentially allowing privilege escalation or denial of service.
Mitigation Recommendations
A patch is available and has been released by Ubuntu in their security notices USN-8575-1 and USN-8576-1. Users should update their Linux kernel packages to the fixed versions and reboot their systems to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigations are specified beyond applying the official kernel updates.
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake… (CVE-2026-64115)
Description
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpected packet type (err = -EINVAL). All destroy: arms now return err < 0, so vmci_transport_recv_listen() removes pending from pending_links synchronously and vsock_pending_work() takes the is_pending=false / !rejected branch, dropping only its own work reference. This also closes the multi-packet race Sashiko reported on v2: pending is removed from the list before any subsequent packet can find it. The pre-existing sk_acceptq_removed() gap on the err < 0 path of vmci_transport_recv_listen() that Sashiko also noted is not introduced or changed by this patch. Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.
CVSS v3.1
Score 8.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's vsock/vmci transport code mishandled a peer reset (RST) packet during connection handshake. Specifically, vmci_transport_recv_connecting_server() returned 0 for a peer RST, causing vmci_transport_recv_listen() to skip removing the pending socket from the listener's pending_links list. This left the socket in TCP_CLOSE state but still referenced. Later, vsock_pending_work() performed cleanup including two sock_put() calls, where the first freed the socket and the second wrote to the freed memory, causing a use-after-free detected by KASAN. This vulnerability (CVE-2026-64115) allows local attackers with limited privileges to cause kernel memory corruption with potential impact on confidentiality, integrity, and availability. Ubuntu has released patches fixing this issue in multiple kernel versions.
Potential Impact
Exploitation of this vulnerability can lead to use-after-free conditions in kernel memory, potentially causing system crashes or allowing attackers to corrupt kernel memory. The CVSS 3.1 score is 8.8 (high severity), indicating significant impact on confidentiality, integrity, and availability. The vulnerability requires local privileges and low attack complexity but no user interaction. It affects systems running vulnerable Linux kernel versions, potentially allowing privilege escalation or denial of service.
Mitigation Recommendations
A patch is available and has been released by Ubuntu in their security notices USN-8575-1 and USN-8576-1. Users should update their Linux kernel packages to the fixed versions and reboot their systems to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigations are specified beyond applying the official kernel updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-c2c8-f8x2-chfh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64115"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a5d27a92a4a8d598912b889
Added to database: 07/19/2026, 19:38:17 UTC
Last enriched: 08/22/2026, 14:28:37 UTC
Last updated: 09/02/2026, 22:52:13 UTC
Views: 93
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.