CVE-2025-21756: vsock: Keep the binding until socket destruction
In the Linux kernel, the following vulnerability has been resolved:
vsock: Keep the binding until socket destruction
Preserve sockets bindings; this includes both resulting from an explicit bind() and those implicitly bound through autobind during connect().
Prevents socket unbinding during a transport reassignment, which fixes a use-after-free:
1. vsockcreate() (refcnt=1) calls vsockinsertunbound() (refcnt=2) 2. transport->release() calls vsockremovebound() without checking if sk was bound and moved to bound list (refcnt=1) 3. vsockbind() assumes sk is in unbound list and before vsockinsertbound(vsockboundsockets()) calls vsockremovebound() which does: listdelinit(&vsk->boundtable); // nop sockput(&vsk->sk); // refcnt=0
BUG: KASAN: slab-use-after-free in vsockbind+0x62e/0x730 Read of size 4 at addr ffff88816b46a74c by task a.out/2057 dumpstacklvl+0x68/0x90 printreport+0x174/0x4f6 kasanreport+0xb9/0x190 vsockbind+0x62e/0x730 vsockbind+0x97/0xe0 sysbind+0x154/0x1f0 x64sysbind+0x6e/0xb0 dosyscall64+0x93/0x1b0 entrySYSCALL64afterhwframe+0x76/0x7e
Allocated by task 2057: kasansavestack+0x1e/0x40 kasansavetrack+0x10/0x30 kasanslaballoc+0x85/0x90 kmemcacheallocnoprof+0x131/0x450 skprotalloc+0x5b/0x220 skalloc+0x2c/0x870 vsockcreate.constprop.0+0x2e/0xb60 vsockcreate+0xe4/0x420 sockcreate+0x241/0x650 syssocket+0xf2/0x1a0 x64syssocket+0x6e/0xb0 dosyscall64+0x93/0x1b0 entrySYSCALL64afterhwframe+0x76/0x7e
Freed by task 2057: kasansavestack+0x1e/0x40 kasansavetrack+0x10/0x30 kasansavefreeinfo+0x37/0x60 kasanslabfree+0x4b/0x70 kmemcachefree+0x1a1/0x590 skdestruct+0x388/0x5a0 vsockbind+0x5e1/0x730 vsockbind+0x97/0xe0 sysbind+0x154/0x1f0 x64sysbind+0x6e/0xb0 dosyscall64+0x93/0x1b0 entrySYSCALL64afterhwframe+0x76/0x7e
refcountt: addition on 0; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcountwarnsaturate+0xce/0x150 RIP: 0010:refcountwarnsaturate+0xce/0x150 vsockbind+0x66d/0x730 vsockbind+0x97/0xe0 sysbind+0x154/0x1f0 x64sysbind+0x6e/0xb0 dosyscall64+0x93/0x1b0 entrySYSCALL64afterhwframe+0x76/0x7e
refcountt: underflow; use-after-free. WARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcountwarnsaturate+0xee/0x150 RIP: 0010:refcountwarnsaturate+0xee/0x150 vsockremovebound+0x187/0x1e0 vsockrelease+0x383/0x4a0 vsockrelease+0x90/0x120 sockrelease+0xa3/0x250 sockclose+0x14/0x20 fput+0x359/0xa80 taskworkrun+0x107/0x1d0 doexit+0x847/0x2560 dogroupexit+0xb8/0x250 x64sysexitgroup+0x3a/0x50 x64syscall+0xfec/0x14f0 dosyscall64+0x93/0x1b0 entrySYSCALL64afterhwframe+0x76/0x7e
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.135-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21756?
CVE-2025-21756 is classified as a moderate severity vulnerability in the Linux kernel.
What impact does CVE-2025-21756 have on system security?
CVE-2025-21756 can lead to improper socket binding, potentially allowing unauthorized access or denial of service.
How do I fix CVE-2025-21756?
To resolve CVE-2025-21756, update the Linux kernel to the latest version where the vulnerability has been patched.
Which Linux kernel versions are affected by CVE-2025-21756?
CVE-2025-21756 affects versions of the Linux kernel prior to the fix provided in the updates.
Is CVE-2025-21756 related to networking in Linux?
Yes, CVE-2025-21756 specifically impacts socket bindings within the networking stack of the Linux kernel.