CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: avoid refilling the RX queue after teardown
Commit b917507e5ad9 ("vsock/virtio: stop workers during the .remove()") made the RX worker jump to its common exit when rxrun is clear. That exit still refills the RX queue when the buffer count is low, so work queued across virtiovsockvqsdel() can add buffers after the virtqueues have been deleted.
BUG: KASAN: slab-use-after-free in virtqueueaddsgs Read of size 4 by task kworker/0:1 Workqueue: virtiovsock virtiotransportrxwork Call Trace: virtqueueaddsgs (drivers/virtio/virtioring.c:2796) virtiovsockrxfill (net/vmwvsock/virtiotransport.c:332) virtiotransportrxwork (net/vmwvsock/virtiotransport.c:701) processonework (kernel/workqueue.c:3314) workerthread (kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) retfromfork (arch/x86/kernel/process.c:158) retfromforkasm (arch/x86/entry/entry64.S:245) ... Freed by task 141: kfree (mm/slub.c:6566) vpdelvq (drivers/virtio/virtiopcicommon.c:259) vpdelvqs (drivers/virtio/virtiopcicommon.c:285) virtiovsockfreeze (net/vmwvsock/virtiotransport.c:912) virtiodevicefreeze (drivers/virtio/virtio.c:658) virtiopcifreeze (drivers/virtio/virtiopcicommon.c:601) pcipmfreeze (drivers/pci/pci-driver.c:1098) devicesuspend (drivers/base/power/main.c:1968) Kernel panic - not syncing: KASAN: paniconwarn set ...
Jump to a no-refill exit when rxrun is clear, leaving the normal exit to replenish a running queue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
Under what condition can this use-after-free occur?
It can occur when RX work remains queued across virtio_vsock_vqs_del() during device teardown or freeze. The worker can reach its exit path and refill the RX queue after the virtqueues have already been deleted.
How can I identify this issue in diagnostic output?
Affected systems may report a KASAN slab-use-after-free in virtqueue_add_sgs from the virtio_vsock workqueue. The trace can include virtio_vsock_rx_fill, virtio_transport_rx_work, virtio_vsock_freeze, and vp_del_vqs.