Executive brief
A vulnerability in the Linux kernel's VMCI transport for virtual sockets can lead to a denial-of-service condition. When certain connection attempts fail, the system incorrectly tracks the number of pending connections, eventually reaching a limit where it refuses all new legitimate connections. This results in a silent failure of network services that rely on these sockets, requiring a system or process restart to restore functionality.
Technical details
A resource leak exists in net/vmw_vsock/vmci_transport.c due to an unbalanced accounting of the accept queue backlog. When vmci_transport_recv_connecting_server() encounters an error (e.g., due to malformed packets or allocation failures), the kernel calls vsock_remove_pending() but fails to call sk_acceptq_removed(). This causes the sk_ack_backlog counter to increment permanently for every failed handshake. Once the counter reaches sk_max_ack_backlog, the listener refuses all subsequent connection attempts with -ECONNREFUSED. The issue is resolved by ensuring sk_acceptq_removed() is called on the error path in vmci_transport_recv_listen().
Affected products
- Linux Linux d021c344051af91f42c5ba9fdedc176740cbd238
Timeline
- 2026-05-26: other: Patch submitted by developer
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/22c587aa3ab1ab5264daff3ec32136fd30436c13
- https://git.kernel.org/stable/c/9698582a4dd9c4a05889d7db96d4c0edc9e69cac
- https://git.kernel.org/stable/c/ba9ad6015937a5e46ba1a31370e3efdec8abbdcc
- https://git.kernel.org/stable/c/bcb275626055df7f8f947f1a349754b4004d9a15
- https://git.kernel.org/stable/c/c05fa14db43ebef3bd862ca9d073981c0358b3f0
- https://git.kernel.org/stable/c/cf7090e255d74c4b61c51f8ede9fcacdd8393b5b
- https://git.kernel.org/stable/c/dfd853197615d322d3a88dbcab91fc0fd2096219