CVE-2026-74613

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: avoid refilling the RX queue after teardown

Commit b917507e5ad9 ("vsock/virtio: stop workers during the .remove()")

made the RX worker jump to its common exit when rx_run is clear. That

exit still refills the RX queue when the buffer count is low, so work

queued across virtio_vsock_vqs_del() can add buffers after the virtqueues

have been deleted.

BUG: KASAN: slab-use-after-free in virtqueue_add_sgs

Read of size 4 by task kworker/0:1

Workqueue: virtio_vsock virtio_transport_rx_work

Call Trace:

virtqueue_add_sgs (drivers/virtio/virtio_ring.c:2796)

virtio_vsock_rx_fill (net/vmw_vsock/virtio_transport.c:332)

virtio_transport_rx_work (net/vmw_vsock/virtio_transport.c:701)

process_one_work (kernel/workqueue.c:3314)

worker_thread (kernel/workqueue.c:3478)

kthread (kernel/kthread.c:436)

ret_from_fork (arch/x86/kernel/process.c:158)

ret_from_fork_asm (arch/x86/entry/entry_64.S:245)

...

Freed by task 14

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References