CVE-2026-80932

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: flush works in dependency order

virtio_vsock_remove() stops the virtqueues and then flushes each work

item before freeing the enclosing virtio_vsock. The current order does

not account for dependencies between those items: tx_work may queue

send_pkt_work, and send_pkt_work may queue rx_work.

In particular, send_pkt_work can set restart_rx and release tx_lock.

The remove path can then stop the queues and flush rx_work before

send_pkt_work queues it. Although the later send_pkt_work flush waits

for that producer to finish, nothing waits for the newly queued rx_work,

so kfree(vsock) can race with it.

KASAN reported:

BUG: KASAN: slab-use-after-free in

virtio_transport_rx_work+0x487/0x4b0

Read of size 8 at addr ffff888114c2b008 by task kworker/1:1/47

Workqueue: virtio_vsock virtio_transport_rx_work

Call Trace:

virtio_transport_rx_work+0x487/0x4b0

process_one_work+0x688/0x1120

worker_t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References