CVE-2026-64115

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vsock/vmci: fix UAF when peer resets connection during handshake

vmci_transport_recv_connecting_server() returned err = 0 for a peer

RST in its default switch arm:

err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;

That made vmci_transport_recv_listen() skip vsock_remove_pending(),

leaving the pending socket on the listener's pending_links with

sk_state = TCP_CLOSE while destroy: still dropped the explicit

reference taken before schedule_delayed_work().

One second later vsock_pending_work() observed is_pending=true and

performed full cleanup: vsock_remove_pending() then the two trailing

sock_put(sk) calls -- the first reached refcount 0 and __sk_freed

the socket, and the second wrote into the freed object:

BUG: KASAN: slab-use-after-free in refcount_warn_saturate

Write of size 4 at addr ffff88800b1cac80 by task kworker

Workqueue: events vsock_pending_work

Treat peer RST like any other unexpe

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References