Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-74614

vsock/virtio: read virtqueues under worker locks

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, and 1 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's running state while retaining a pointer to the deleted queue. Read each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 762c251c7f5c4ee5bef71460c6e822ed293fd69f · fixed in 941329ce14c5f481223a10d1d4c8b57ea7f3048a; From bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c · fixed in 29dd10583bf9d2744cd84b862e4257c0a5699570; From bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c · fixed in a1fb0c5b8a7c2753758aeced40971f99449dde0c; From bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c · fixed in eae099c764c7ebdb842eb1f638913e310bdd6513; From bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c · fixed in bd43a7ec668be428265b3209eb43647aedcf720a; From bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c · fixed in 1cecb4202afdbeddcf29d59baf596ac6ab753f7f; From bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c · fixed in ebac8f6b1ef0e9278afe204b8692a7479988dace; From 5.15.138 · fixed in 5.15.216

  • Linux Linux

    5.19

  • KernelLinux

    fixed in 5.15.216; From 5.16.0 · fixed in 6.1.183; From 5.19.0 · fixed in 6.6.152; From 6.2.0 · fixed in 6.12.104; From 6.7.0 · fixed in 6.18.45; From 6.13.0 · fixed in 7.1.9

References 7

git.kernel.org