CVE-2025-21756

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vsock: Keep the binding until socket destruction

Preserve sockets bindings; this includes both resulting from an explicit

bind() and those implicitly bound through autobind during connect().

Prevents socket unbinding during a transport reassignment, which fixes a

use-after-free:

1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2)

2. transport->release() calls vsock_remove_bound() without checking if

sk was bound and moved to bound list (refcnt=1)

3. vsock_bind() assumes sk is in unbound list and before

__vsock_insert_bound(vsock_bound_sockets()) calls

__vsock_remove_bound() which does:

list_del_init(&vsk->bound_table); // nop

sock_put(&vsk->sk); // refcnt=0

BUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730

Read of size 4 at addr ffff88816b46a74c by task a.out/2057

dump_stack_lvl+0x68/0x90

print_report+0x174/0x4f6

kas

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References