PT-2026-52277 · Linux · Linux

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-53181

Mitre

In the Linux kernel, the following vulnerability has been resolved:

vsock/vmci: fix sk ack backlog leak on failed handshake

When vmci transport recv connecting server() returns an error, vmci transport recv listen() calls vsock remove pending() but never calls sk acceptq removed(). This leaves sk ack backlog incremented permanently.

Repeated handshake failures (malformed packets, queue pair alloc failure, event subscribe failure) cause sk ack backlog to climb toward sk max ack backlog. Once it reaches the limit the listener permanently refuses all new connections with -ECONNREFUSED, a silent denial of service requiring a process restart to recover.

The two existing sk acceptq removed() calls in af vsock.c do not cover this path: line 764 checks vsock is pending() which returns false after vsock remove pending(), and line 1889 is only reached on successful accept().

Fix by balancing sk acceptq added() with sk acceptq removed() on the error path.

Related Identifiers

CVE-2026-53181

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53181 · Security Note
• https://git.kernel.org/stable/c/cf7090e255d74c4b61c51f8ede9fcacdd8393b5b · Note
• https://git.kernel.org/stable/c/c05fa14db43ebef3bd862ca9d073981c0358b3f0 · Note
• https://git.kernel.org/stable/c/ba9ad6015937a5e46ba1a31370e3efdec8abbdcc · Note
• https://git.kernel.org/stable/c/bcb275626055df7f8f947f1a349754b4004d9a15 · Note
• https://git.kernel.org/stable/c/22c587aa3ab1ab5264daff3ec32136fd30436c13 · Note
• https://git.kernel.org/stable/c/dfd853197615d322d3a88dbcab91fc0fd2096219 · Note
• https://git.kernel.org/stable/c/ea0b03d52881c12a8c634ea0d6cbfa61cefdb488 · Note
• https://git.kernel.org/stable/c/9698582a4dd9c4a05889d7db96d4c0edc9e69cac · Note