Executive brief
A vulnerability in the Linux kernel's networking component could allow an attacker to disable certain communication services. By repeatedly attempting to connect using mismatched transport settings, an attacker can cause the system to incorrectly track the number of active connections. Once the system believes the connection limit has been reached, it will stop accepting all new legitimate connections, leading to a denial of service for applications relying on virtio-based communication.
Technical details
A logic error in virtio_transport_recv_listen() causes an accept queue count leak. The function calls sk_acceptq_added() to increment the backlog counter before validating the transport via vsock_assign_transport(). If the transport assignment fails or a different transport is selected, the code returns an error without calling sk_acceptq_removed(). This results in a permanent increment of sk_ack_backlog; once this value exceeds the configured backlog limit, sk_acceptq_is_full() returns true, and the listener rejects all subsequent connection attempts. The fix involves reordering the calls so the queue count is only incremented after successful transport validation.
Affected products
- Linux Linux kernel All versions supporting multi-transport vsock prior to the fix
Timeline
- 2026-04-13: other: Patch authored by Dudu Lu
- 2026-05-28: advisory: CVE-2026-46214 published by NVD
References
- https://git.kernel.org/stable/c/29371f3cc83e2a92265b4768014a30b80234112f
- https://git.kernel.org/stable/c/52bcb57a4e8a0865a76c587c2451906342ae1b2d
- https://git.kernel.org/stable/c/65c484726e74013a2ec7ba67a34d87760ae8f390
- https://git.kernel.org/stable/c/6d3275fc4ed968938e1d556c344798046776668d
- https://git.kernel.org/stable/c/e9edf9893cf26d060705c910a9b62d8cc96ed56a