Executive brief
The Linux kernel's virtio vsock driver has a use-after-free vulnerability in the RX queue refill logic after device teardown. An attacker with local access could trigger a kernel panic or potentially execute code by causing the driver to access freed memory when processing queued work after virtqueue deletion. This affects systems using vsock for inter-VM communication.
Technical details
The vulnerability is a use-after-free (CWE-416) in the vsock/virtio transport layer. When the rx_run flag is cleared during device teardown (via .remove()), the RX worker thread may still attempt to refill the RX queue via virtio_vsock_rx_fill(), accessing virtqueue structures that have already been freed by virtio_vsock_vqs_del(). The work can be queued and executed after virtqueues are deleted, causing virtqueue_add_sgs() to operate on freed memory. Exploitation requires local access to trigger device removal or suspend while RX work is pending. A KASAN slab-use-after-free error and kernel panic are observable. The fix skips queue refill when rx_run is clear, ensuring the normal exit path only replenishes actively running queues.
Affected products
- Linux Linux kernel Affected versions unknown; resolved in kernel subsystem net/vmw_vsock/virtio_transport.c
Timeline
- 2026-08-22: disclosed
- patched: Fix applied to net/vmw_vsock/virtio_transport.c to skip refill when rx_run is clear