CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: avoid refilling the RX queue after teardown

Commit b917507e5ad9 ("vsock/virtio: stop workers during the .remove()") made the RX worker jump to its common exit when rxrun is clear. That exit still refills the RX queue when the buffer count is low, so work queued across virtiovsockvqsdel() can add buffers after the virtqueues have been deleted.

BUG: KASAN: slab-use-after-free in virtqueueaddsgs Read of size 4 by task kworker/0:1 Workqueue: virtiovsock virtiotransportrxwork Call Trace: virtqueueaddsgs (drivers/virtio/virtioring.c:2796) virtiovsockrxfill (net/vmwvsock/virtiotransport.c:332) virtiotransportrxwork (net/vmwvsock/virtiotransport.c:701) processonework (kernel/workqueue.c:3314) workerthread (kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) retfromfork (arch/x86/kernel/process.c:158) retfromforkasm (arch/x86/entry/entry64.S:245) ... Freed by task 141: kfree (mm/slub.c:6566) vpdelvq (drivers/virtio/virtiopcicommon.c:259) vpdelvqs (drivers/virtio/virtiopcicommon.c:285) virtiovsockfreeze (net/vmwvsock/virtiotransport.c:912) virtiodevicefreeze (drivers/virtio/virtio.c:658) virtiopcifreeze (drivers/virtio/virtiopcicommon.c:601) pcipmfreeze (drivers/pci/pci-driver.c:1098) devicesuspend (drivers/base/power/main.c:1968) Kernel panic - not syncing: KASAN: paniconwarn set ...

Jump to a no-refill exit when rxrun is clear, leaving the normal exit to replenish a running queue.