CVE-2026-53181: Linux Kernel vsock/vmci Resource Leak Denial of Service

Technical summary

The vulnerability exists in the vmci_transport_recv_listen() function's error handling path. When vmci_transport_recv_connecting_server() fails, the code calls vsock_remove_pending() to remove the pending connection from the queue, but omits the corresponding sk_acceptq_removed() call that decrements the sk_ack_backlog counter. The sk_acceptq_removed() calls at lines 764 and 1889 in af_vsock.c do not cover this path because line 764's conditional check fails after vsock_remove_pending() executes, and line 1889 is only reachable on successful accept(). This leaves sk_ack_backlog permanently incremented, eventually causing it to reach sk_max_ack_backlog and trigger denial of service. The fix requires adding sk_acceptq_removed() to the error handling path to balance the earlier sk_acceptq_added() call.

Business impact

Systems relying on vsock for guest-to-host communication (primarily virtual machines in VMware environments) face availability risk. Repeated handshake failures—whether from network issues, resource contention, or malformed packets—will eventually exhaust the listener's connection queue, causing all new connection attempts to fail with -ECONNREFUSED. Applications depending on stable host-guest communication will lose connectivity and require manual intervention to restart the listener process. For environments running multiple VMs or handling high connection turnover, this becomes a practical denial of service affecting workload reliability.

Affected systems

Linux kernel systems using vsock with VMCI transport, primarily virtual machines running under VMware hypervisors. The vulnerability affects the Linux kernel versions where this code path exists; specific patched versions should be verified against vendor advisories. Any guest operating system using the kernel vsock/vmci module is potentially affected.

Exploitability

Exploitability requires local access to trigger the vsock handshake path and generate repeated failures. An unprivileged local user can craft malformed vsock packets or trigger conditions (such as queue pair allocation failures) that cause handshake errors. However, exploitation is not straightforward—it requires understanding vsock protocol mechanics and may depend on system resource state. The attack is not remotely exploitable and requires no special privileges beyond local process execution, though CVSS reflects the local-only attack vector (AV:L).

Remediation

Apply a Linux kernel update that includes the fix to properly call sk_acceptq_removed() in the vmci_transport_recv_listen() error path. Verify the specific patched kernel version through your Linux distribution's security advisory. As an interim mitigation, monitor systems for connection refusal errors and implement watchdog logic to restart listener processes automatically, though this does not address the root cause.

Patch guidance

Check your Linux vendor's security advisory for the patched kernel version addressing CVE-2026-53181. Ubuntu, Red Hat, Debian, and other distributions will issue updates through their standard channels. Apply the kernel patch and reboot affected systems. Test in non-production environments first, particularly for systems with custom networking configurations or virtual machine managers that rely on vsock.

Detection guidance

Monitor system logs and application logs for repeated -ECONNREFUSED errors on vsock connections. Track sk_ack_backlog growth using netstat or similar tools for listening sockets. Implement alerting on sustained connection refusal patterns from guest-to-host communication. On patched systems, validate that failed handshakes no longer cause persistent sk_ack_backlog accumulation by reviewing kernel debugging counters before and after connection failures.

Why prioritize this

This is a medium-severity availability issue that turns transient connection problems into permanent denial of service. While the initial trigger requires local access, the impact is silent and cumulative—administrators may not notice the problem until all connectivity is lost. For environments where guest-to-host communication is critical infrastructure (cloud deployments, containerized systems, or VM farms), the practical business impact justifies prompt patching. The lack of active exploitation (not on KEV) suggests this is a defensive fix rather than a critical emergency, but the availability impact warrants treatment as a high-priority maintenance item.

Risk score, explained

CVSS 5.5 (Medium) reflects a high-impact availability attack (A:H) that requires local access (AV:L) and low privileges (PR:L). The score appropriately captures that this is not a critical remote vulnerability but represents a material risk to system availability for local users. The CWE-401 (Missing Release of Memory) classification correctly identifies the resource leak nature of the defect.

Frequently asked questions