CVE-2026-74614

Summary

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: read virtqueues under worker locks

Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's running state while retaining a pointer to the deleted queue.

Read each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux762c251c7f5c4ee5bef71460c6e822ed293fd69f < 941329ce14c5f481223a10d1d4c8b57ea7f3048aaffected
LinuxLinuxbd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c < 29dd10583bf9d2744cd84b862e4257c0a5699570affected
LinuxLinuxbd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c < a1fb0c5b8a7c2753758aeced40971f99449dde0caffected
LinuxLinuxbd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c < eae099c764c7ebdb842eb1f638913e310bdd6513affected
LinuxLinuxbd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c < bd43a7ec668be428265b3209eb43647aedcf720aaffected
LinuxLinuxbd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c < 1cecb4202afdbeddcf29d59baf596ac6ab753f7faffected
LinuxLinuxbd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c < ebac8f6b1ef0e9278afe204b8692a7479988daceaffected
LinuxLinux5.15.138 < 5.15.216affected
LinuxLinux5.19affected
LinuxLinux0 < 5.19unaffected
LinuxLinux5.15.216 <= 5.15.*unaffected
LinuxLinux6.1.183 <= 6.1.*unaffected
LinuxLinux6.6.152 <= 6.6.*unaffected
LinuxLinux6.12.104 <= 6.12.*unaffected
LinuxLinux6.18.45 <= 6.18.*unaffected
LinuxLinux7.1.9 <= 7.1.*unaffected
LinuxLinux7.2 <= *unaffected

Weaknesses

References