CVE-2026-90138

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vsock: don't check the listener's sk_err in vsock_accept()

Syzbot reported an issue which can be reproduced with these steps:

r0 = socket(AF_VSOCK, SOCK_STREAM, 0)

bind(r0, {VMADDR_CID_ANY, PORT})

connect(r0, {VMADDR_CID_LOCAL, PORT}) -> -1, EPROTO (self-connect)

listen(r0, backlog) -> 0

r1 = socket(AF_VSOCK, SOCK_STREAM, 0)

connect(r1, {VMADDR_CID_LOCAL, PORT}) -> 0

accept(r0) -> -1, EPROTO (stale sk_err)

Basically, it creates a socket (r0) and triggers a self-connect after

binding it. This self-connect fails with EPROTO because it loops back

to r0 while the socket is still in the TCP_SYN_SENT state, causing it

to be incorrectly dispatched to the connecting-client path. The

unexpected packet type encountered there sets sk_err to EPROTO.

After that, it invokes a listen() call on the same socket. This

listen() call succeeds because the kernel's listening path never

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References