SECUFOCUSNOW
Home›CVE index›CVE-2026-64115
Review reviewHigh

CVE-2026-64115

Linux

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending...

CVSS
8.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.20
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 8.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending...

Affected product and versions

Product
Linux
Affected versions
>= d021c344051af91f42c5ba9fdedc176740cbd238 < 1e19f08552b90070ed18bafb1763c78297823af6, >= d021c344051af91f42c5ba9fdedc176740cbd238 < 1dd531e28f61edd286edc486ab068f135b5ae1eb, >= d021c344051af91f42c5ba9fdedc176740cbd238 < ecda37f8faab3220da199335e42564cb7a9ad145, >= d021c344051af91f42c5ba9fdedc176740cbd238 < cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb, >= d021c344051af91f42c5ba9fdedc176740cbd238 < 47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9, >= d021c344051af91f42c5ba9fdedc176740cbd238 < 440447699c681e26ed58e9c309cad718270a18b4, >= d021c344051af91f42c5ba9fdedc176740cbd238 < 9fe74e42914c851d68069713b7b917a9c33faf26, >= d021c344051af91f42c5ba9fdedc176740cbd238 < 99e22ddf4edb63dc8382bc028af928056d3450cf, >= 3.9
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE
Not available