UBUNTU-CVE-2026-74613: Use After Free
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: avoid refilling the RX queue after teardown Commit b917507e5ad9 ("vsock/virtio: stop workers during the .remove()") made the RX worker jump to its common exit when rxrun is clear. That exit still refills the RX queue when the buffer count is low, so work queued across virtiovsockvqsdel() can add buffers after the virtqueues have been deleted. BUG: KASAN: slab-use-after-free in virtqueueaddsgs Read of size 4 by task kworker/0:1 Workqueue: virtiovsock virtiotransportrxwork Call Trace: virtqueueaddsgs (drivers/virtio/virtioring.c:2796) virtiovsockrxfill (net/vmwvsock/virtiotransport.c:332) virtiotransportrxwork (net/vmwvsock/virtiotransport.c:701) processonework (kernel/workqueue.c:3314) workerthread (kernel/workqueue.c:3478) kthread (kernel/kthread.c:436) retfromfork (arch/x86/kernel/process.c:158) retfromforkasm (arch/x86/entry/entry64.S:245) ... Freed by task 141: kfree (mm/slub.c:6566) vpdelvq (drivers/virtio/virtiopcicommon.c:259) vpdelvqs (drivers/virtio/virtiopcicommon.c:285) virtiovsockfreeze (net/vmwvsock/virtiotransport.c:912) virtiodevicefreeze (drivers/virtio/virtio.c:658) virtiopcifreeze (drivers/virtio/virtiopcicommon.c:601) pcipmfreeze (drivers/pci/pci-driver.c:1098) devicesuspend (drivers/base/power/main.c:1968) Kernel panic - not syncing: KASAN: paniconwarn set ... Jump to a no-refill exit when rxrun is clear, leaving the normal exit to replenish a running queue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1117.124~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1123.132~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1122.131~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1118.128~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-198.208~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1111.115~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1112.118~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-195.205~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.120~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1111.115~20.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-198.208 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1117.124 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1123.132 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1122.131 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1118.128 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1113.119 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1100.108 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1111.115 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1112.118 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1109.114 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-195.205 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1112.113 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-xilinx-zynqmpto a version that resolves this vulnerability.Fixed in 5.15.0-1080.84 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1101.103 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1109.111 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1116.125 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1117.124+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1123.132+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-198.208+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1118.128+fips1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch b917507e5ad9
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected software list includes Ubuntu linux, linux-azure, linux-gcp, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, and linux-realtime kernel packages. The vulnerable code is in the virtio vsock transport path.
What conditions are required to trigger the flaw?
An attacker needs local access and low privileges; no user interaction is required. The issue is triggered when queued virtio-vsock RX work runs after virtqueues have been deleted during device teardown or freeze, causing the worker to refill a deleted RX queue.
What is the potential impact?
The race produces a slab use-after-free in virtqueue_add_sgs. The supplied severity vector rates confidentiality, integrity, and availability impact as high.
How can administrators recognize the issue on an affected system?
A triggered condition may produce a KASAN slab-use-after-free report involving virtqueue_add_sgs, virtio_vsock_rx_fill, and virtio_transport_rx_work. The teardown path in the report includes virtio_vsock_freeze and virtio_vsock_vqs_del-related virtqueue deletion.