UBUNTU-CVE-2026-80932: Use After Free

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtiovsockremove() stops the virtqueues and then flushes each work item before freeing the enclosing virtiovsock. The current order does not account for dependencies between those items: txwork may queue sendpktwork, and sendpktwork may queue rxwork. In particular, sendpktwork can set restartrx and release txlock. The remove path can then stop the queues and flush rxwork before sendpktwork queues it. Although the later sendpktwork flush waits for that producer to finish, nothing waits for the newly queued rxwork, so kfree(vsock) can race with it. KASAN reported: BUG: KASAN: slab-use-after-free in virtiotransportrxwork+0x487/0x4b0 Read of size 8 at addr ffff888114c2b008 by task kworker/1:1/47 Workqueue: virtiovsock virtiotransportrxwork Call Trace: virtiotransportrxwork+0x487/0x4b0 processonework+0x688/0x1120 workerthread+0x45b/0xd10 Allocated by task 1: virtiovsockprobe+0xef/0x6b0 Freed by task 84: kfree+0x131/0x3c0 virtiovsockremove+0xd1/0x100 Flush the works in producer-to-consumer order. virtiovsockvqsdel() has already disabled the queue callbacks and cleared the run flags, so after txwork and sendpktwork are drained, no source remains that can queue rxwork after its flush.