{ "advisories": [ { "id": "USN-8575-1", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8575-1" }, { "id": "USN-8576-1", "source": "usn", "title": "Linux kernel (NVIDIA Tegra) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8576-1" }, { "id": "USN-8593-1", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8593-1" }, { "id": "USN-8575-2", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8575-2" }, { "id": "USN-8576-2", "source": "usn", "title": "Linux kernel (NVIDIA Tegra) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8576-2" }, { "id": "USN-8575-3", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8575-3" }, { "id": "USN-8603-1", "source": "usn", "title": "Linux kernel (Azure) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8603-1" }, { "id": "USN-8610-1", "source": "usn", "title": "Linux kernel (Azure CVM) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8610-1" }, { "id": "USN-8618-1", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8618-1" }, { "id": "USN-8620-1", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8620-1" }, { "id": "USN-8620-2", "source": "usn", "title": "Linux kernel (Azure FIPS) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8620-2" }, { "id": "USN-8620-3", "source": "usn", "title": "Linux kernel (Intel IoTG) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8620-3" }, { "id": "USN-8620-4", "source": "usn", "title": "Linux kernel (Intel IoTG) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8620-4" }, { "id": "USN-8663-1", "source": "usn", "title": "Linux kernel (NVIDIA) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8663-1" }, { "id": "USN-8664-1", "source": "usn", "title": "Linux kernel (NVIDIA BaseOS) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8664-1" }, { "id": "USN-8668-1", "source": "usn", "title": "Linux kernel (GCP) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8668-1" }, { "id": "USN-8728-1", "source": "usn", "title": "Linux kernel (GCP) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8728-1" }, { "id": "USN-8729-1", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8729-1" }, { "id": "USN-8761-1", "source": "usn", "title": "Linux kernel (Azure) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8761-1" }, { "id": "USN-8729-2", "source": "usn", "title": "Linux kernel (Raspberry Pi Real-time) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8729-2" }, { "id": "USN-8761-2", "source": "usn", "title": "Linux kernel (Azure FIPS) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8761-2" }, { "id": "USN-8781-1", "source": "usn", "title": "Linux kernel (NVIDIA Tegra) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8781-1" }, { "id": "USN-8668-2", "source": "usn", "title": "Linux kernel (Raspberry Pi) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8668-2" }, { "id": "USN-8729-3", "source": "usn", "title": "Linux kernel vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8729-3" }, { "id": "USN-8802-1", "source": "usn", "title": "Linux kernel (Oracle) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8802-1" }, { "id": "USN-8728-2", "source": "usn", "title": "Linux kernel (Azure) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8728-2" }, { "id": "USN-8729-4", "source": "usn", "title": "Linux kernel (Low Latency) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8729-4" }, { "id": "USN-8729-5", "source": "usn", "title": "Linux kernel (AWS FIPS) vulnerabilities", "url": "https://ubuntu.com/security/notices/USN-8729-5" } ], "cve": "CVE-2026-64115", "enrichment": { "affected": [ { "configurations": [ { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,1e19f08552b90070ed18bafb1763c78297823af6)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,1dd531e28f61edd286edc486ab068f135b5ae1eb)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,ecda37f8faab3220da199335e42564cb7a9ad145)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,440447699c681e26ed58e9c309cad718270a18b4)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,9fe74e42914c851d68069713b7b917a9c33faf26)" } }, { "platform": null, "status": "affected", "versions": { "scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,99e22ddf4edb63dc8382bc028af928056d3450cf)" } } ], "enrichment": { "confidence": 99.0, "confidence_source": "inferred", "scores": [ { "score": 99.0, "source": "inferred" }, { "score": 100.0, "source": "matching" } ] }, "original": { "product": "Linux", "source": "cna", "vendor": "Linux" }, "product": "linux_kernel", "vendor": "linux" }, { "configurations": [ { "platform": null, "status": "affected", "versions": { "scheme": "semver", "value": "3.9" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[0,3.9)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[5.10.258,5.11.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[5.15.209,5.16.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[6.1.175,6.2.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[6.6.142,6.7.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[6.12.92,6.13.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[6.18.34,6.19.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "semver", "value": "[7.0.11,7.1.0)" } }, { "platform": null, "status": "unaffected", "versions": { "scheme": "generic", "value": "[7.1,*]" } } ], "enrichment": { "confidence": 99.0, "confidence_source": "inferred", "scores": [ { "score": 99.0, "source": "inferred" }, { "score": 100.0, "source": "matching" } ] }, "original": { "product": "Linux", "source": "cna", "vendor": "Linux" }, "product": "linux_kernel", "vendor": "linux" } ], "created": "2026-07-21T10:45:02.435175+00:00", "updated": "2026-08-13T13:00:04.983282+00:00", "vendors": [ "linux", "linux$PRODUCT$linux_kernel" ] }, "epss": { "score": 0.00171 }, "mitre": { "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "created": "2026-07-19T15:40:15.513000+00:00", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: fix UAF when peer resets connection during handshake\n\nvmci_transport_recv_connecting_server() returned err = 0 for a peer\nRST in its default switch arm:\n\n\terr = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;\n\nThat made vmci_transport_recv_listen() skip vsock_remove_pending(),\nleaving the pending socket on the listener's pending_links with\nsk_state = TCP_CLOSE while destroy: still dropped the explicit\nreference taken before schedule_delayed_work().\n\nOne second later vsock_pending_work() observed is_pending=true and\nperformed full cleanup: vsock_remove_pending() then the two trailing\nsock_put(sk) calls -- the first reached refcount 0 and __sk_freed\nthe socket, and the second wrote into the freed object:\n\n BUG: KASAN: slab-use-after-free in refcount_warn_saturate\n Write of size 4 at addr ffff88800b1cac80 by task kworker\n Workqueue: events vsock_pending_work\n\nTreat peer RST like any other unexpected packet type (err = -EINVAL).\nAll destroy: arms now return err < 0, so vmci_transport_recv_listen()\nremoves pending from pending_links synchronously and\nvsock_pending_work() takes the is_pending=false / !rejected branch,\ndropping only its own work reference. This also closes the\nmulti-packet race Sashiko reported on v2: pending is removed from\nthe list before any subsequent packet can find it.\n\nThe pre-existing sk_acceptq_removed() gap on the err < 0 path of\nvmci_transport_recv_listen() that Sashiko also noted is not\nintroduced or changed by this patch.\n\nTested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": { "score": 8.8, "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, "cvssV4_0": {} }, "mitre_repo_path": "cves/2026/64xxx/CVE-2026-64115.json", "references": [ "https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb", "https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6", "https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4", "https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9", "https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf", "https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26", "https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb", "https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145" ], "title": "vsock/vmci: fix UAF when peer resets connection during handshake", "updated": "2026-08-05T12:39:24.360000+00:00", "vendors": [ "linux", "linux$PRODUCT$linux_kernel" ], "weaknesses": [] }, "nvd": { "cpes": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*" ], "created": "2026-07-19T16:17:52.967000+00:00", "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: fix UAF when peer resets connection during handshake\n\nvmci_transport_recv_connecting_server() returned err = 0 for a peer\nRST in its default switch arm:\n\n\terr = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;\n\nThat made vmci_transport_recv_listen() skip vsock_remove_pending(),\nleaving the pending socket on the listener's pending_links with\nsk_state = TCP_CLOSE while destroy: still dropped the explicit\nreference taken before schedule_delayed_work().\n\nOne second later vsock_pending_work() observed is_pending=true and\nperformed full cleanup: vsock_remove_pending() then the two trailing\nsock_put(sk) calls -- the first reached refcount 0 and __sk_freed\nthe socket, and the second wrote into the freed object:\n\n BUG: KASAN: slab-use-after-free in refcount_warn_saturate\n Write of size 4 at addr ffff88800b1cac80 by task kworker\n Workqueue: events vsock_pending_work\n\nTreat peer RST like any other unexpected packet type (err = -EINVAL).\nAll destroy: arms now return err < 0, so vmci_transport_recv_listen()\nremoves pending from pending_links synchronously and\nvsock_pending_work() takes the is_pending=false / !rejected branch,\ndropping only its own work reference. This also closes the\nmulti-packet race Sashiko reported on v2: pending is removed from\nthe list before any subsequent packet can find it.\n\nThe pre-existing sk_acceptq_removed() gap on the err < 0 path of\nvmci_transport_recv_listen() that Sashiko also noted is not\nintroduced or changed by this patch.\n\nTested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": { "score": 8.8, "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, "cvssV4_0": {} }, "nvd_repo_path": "2026/CVE-2026-64115.json", "references": [ "https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb", "https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6", "https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4", "https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9", "https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf", "https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26", "https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb", "https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145" ], "title": null, "updated": "2026-08-12T15:50:13.127000+00:00", "vendors": [ "linux", "linux$PRODUCT$linux_kernel" ], "weaknesses": [ "CWE-416" ] }, "opencve": { "changes": [ { "created": "2026-07-19T16:15:00+00:00", "data": [ { "details": { "new": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: fix UAF when peer resets connection during handshake\n\nvmci_transport_recv_connecting_server() returned err = 0 for a peer\nRST in its default switch arm:\n\n\terr = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;\n\nThat made vmci_transport_recv_listen() skip vsock_remove_pending(),\nleaving the pending socket on the listener's pending_links with\nsk_state = TCP_CLOSE while destroy: still dropped the explicit\nreference taken before schedule_delayed_work().\n\nOne second later vsock_pending_work() observed is_pending=true and\nperformed full cleanup: vsock_remove_pending() then the two trailing\nsock_put(sk) calls -- the first reached refcount 0 and __sk_freed\nthe socket, and the second wrote into the freed object:\n\n BUG: KASAN: slab-use-after-free in refcount_warn_saturate\n Write of size 4 at addr ffff88800b1cac80 by task kworker\n Workqueue: events vsock_pending_work\n\nTreat peer RST like any other unexpected packet type (err = -EINVAL).\nAll destroy: arms now return err < 0, so vmci_transport_recv_listen()\nremoves pending from pending_links synchronously and\nvsock_pending_work() takes the is_pending=false / !rejected branch,\ndropping only its own work reference. This also closes the\nmulti-packet race Sashiko reported on v2: pending is removed from\nthe list before any subsequent packet can find it.\n\nThe pre-existing sk_acceptq_removed() gap on the err < 0 path of\nvmci_transport_recv_listen() that Sashiko also noted is not\nintroduced or changed by this patch.\n\nTested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.", "old": null }, "type": "description" }, { "details": { "new": "vsock/vmci: fix UAF when peer resets connection during handshake", "old": null }, "type": "title" }, { "details": [ "linux", "linux$PRODUCT$linux_kernel" ], "type": "first_time" }, { "details": { "added": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*" ], "removed": [] }, "type": "cpes" }, { "details": { "added": [ "linux", "linux$PRODUCT$linux_kernel" ], "removed": [] }, "type": "vendors" }, { "details": { "added": [ "https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb", "https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6", "https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4", "https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9", "https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf", "https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26", "https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb", "https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145" ], "removed": [] }, "type": "references" } ], "id": "dfb0f5ae-a461-46c5-8a57-3f525cb7b2b1" }, { "created": "2026-07-20T12:15:00+00:00", "data": [ { "details": { "added": [ "CWE-787" ], "removed": [] }, "type": "weaknesses" }, { "details": { "added": [ "https://lore.kernel.org/linux-cve-announce/2026071923-CVE-2026-64115-de9e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64115", "https://www.cve.org/CVERecord?id=CVE-2026-64115" ], "removed": [] }, "type": "references" }, { "details": { "added": { "cvssV3_1": { "score": 7.0, "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } }, "removed": {}, "updated": { "threat_severity": { "new": "Moderate", "old": null } } }, "type": "metrics" } ], "id": "987fae16-efcc-44fe-ab39-c8d4ddc716c7" }, { "created": "2026-07-20T14:45:00+00:00", "data": [ { "details": { "added": {}, "removed": {}, "updated": { "cvssV3_1": { "new": { "score": 8.8, "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, "old": { "score": 7.0, "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } } } }, "type": "metrics" } ], "id": "e5a16e53-efa4-4cb2-b6cd-3c72aff96ce7" }, { "created": "2026-08-12T16:00:00+00:00", "data": [ { "details": { "added": [ "CWE-416" ], "removed": [] }, "type": "weaknesses" }, { "details": { "added": [ "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*" ], "removed": [] }, "type": "cpes" } ], "id": "0b7bd27b-d7a8-4208-a65a-ce9825526848" } ], "cpes": { "data": [ "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*" ], "providers": [ "mitre", "nvd" ] }, "created": { "data": "2026-07-19T00:00:00+00:00", "provider": "redhat" }, "description": { "data": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: fix UAF when peer resets connection during handshake\n\nvmci_transport_recv_connecting_server() returned err = 0 for a peer\nRST in its default switch arm:\n\n\terr = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;\n\nThat made vmci_transport_recv_listen() skip vsock_remove_pending(),\nleaving the pending socket on the listener's pending_links with\nsk_state = TCP_CLOSE while destroy: still dropped the explicit\nreference taken before schedule_delayed_work().\n\nOne second later vsock_pending_work() observed is_pending=true and\nperformed full cleanup: vsock_remove_pending() then the two trailing\nsock_put(sk) calls -- the first reached refcount 0 and __sk_freed\nthe socket, and the second wrote into the freed object:\n\n BUG: KASAN: slab-use-after-free in refcount_warn_saturate\n Write of size 4 at addr ffff88800b1cac80 by task kworker\n Workqueue: events vsock_pending_work\n\nTreat peer RST like any other unexpected packet type (err = -EINVAL).\nAll destroy: arms now return err < 0, so vmci_transport_recv_listen()\nremoves pending from pending_links synchronously and\nvsock_pending_work() takes the is_pending=false / !rejected branch,\ndropping only its own work reference. This also closes the\nmulti-packet race Sashiko reported on v2: pending is removed from\nthe list before any subsequent packet can find it.\n\nThe pre-existing sk_acceptq_removed() gap on the err < 0 path of\nvmci_transport_recv_listen() that Sashiko also noted is not\nintroduced or changed by this patch.\n\nTested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.", "provider": "mitre" }, "metrics": { "cvssV2_0": { "data": {}, "provider": null }, "cvssV3_0": { "data": {}, "provider": null }, "cvssV3_1": { "data": { "score": 8.8, "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" }, "provider": "mitre" }, "cvssV4_0": { "data": {}, "provider": null }, "epss": { "data": { "score": 0.00171 }, "provider": "first" }, "kev": { "data": {}, "provider": null }, "ssvc": { "data": {}, "provider": null }, "threat_severity": { "data": "Moderate", "provider": "redhat" } }, "references": { "data": [ "https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb", "https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6", "https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4", "https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9", "https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf", "https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26", "https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb", "https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145", "https://lore.kernel.org/linux-cve-announce/2026071923-CVE-2026-64115-de9e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64115", "https://www.cve.org/CVERecord?id=CVE-2026-64115" ], "providers": [ "mitre", "nvd", "redhat" ] }, "title": { "data": "vsock/vmci: fix UAF when peer resets connection during handshake", "provider": "mitre" }, "updated": { "data": "2026-08-12T15:50:13.127000+00:00", "provider": "nvd" }, "vendors": { "data": [ "linux", "linux$PRODUCT$linux_kernel" ], "providers": [ "mitre", "nvd", "enrichment" ] }, "weaknesses": { "data": [ "CWE-416", "CWE-787" ], "providers": [ "nvd", "redhat" ] } }, "redhat": { "cpes": [], "created": "2026-07-19T00:00:00+00:00", "description": "A flaw was found in the `vsock/vmci` component of the Linux kernel. A remote attacker could exploit a Use-After-Free (UAF) vulnerability when a peer resets a connection during the handshake process. This occurs because the system incorrectly handles reset packets, leading to a pending socket being left in an invalid state. Exploiting this flaw could cause a system crash, resulting in a Denial of Service (DoS).", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": { "score": 7.0, "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, "threat_severity": "Moderate" }, "redhat_repo_path": "2026/CVE-2026-64115.json", "references": [ "https://lore.kernel.org/linux-cve-announce/2026071923-CVE-2026-64115-de9e@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-64115", "https://www.cve.org/CVERecord?id=CVE-2026-64115" ], "title": "kernel: vsock/vmci: fix UAF when peer resets connection during handshake", "updated": "2026-07-19T00:00:00+00:00", "vendors": [], "weaknesses": [ "CWE-787" ] } }