Skip to content
Heist/ feed
High

vsock: Keep the binding until socket destruction

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind() and those implicitly bound through autobind during connect(). Prevents socket unbinding during a transport reassignment, which fixes a use-after-free: 1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2) 2. transport->release() calls vsock_remove_bound() without checking if sk was bound and moved to bound list (refcnt=1) 3. vsock_bind() assumes sk is in unbound list and before __vsock_insert_bound(vsock_bound_sockets()) calls __vsock_remove_bound() which does: list_del_init(&vsk->bound_table); // nop sock_put(&vsk->sk); // refcnt=0 BUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730 Read of size 4 at addr ffff88816b46a74c by task a.out/2057 dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 __vsock_bind+0x62e/0x730 vsock_bind+0x97/0xe0 __sys_bind+0x154/0x1f0 __x64_sys_bind+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 2057: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 __vsock_create.constprop.0+0x2e/0xb60 vsock_create+0xe4/0x420 __sock_create+0x241/0x650 __sys_socket+0xf2/0x1a0 __x64_sys_socket+0x6e/0xb0 do_syscall_64+0x93/0x1b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fre

Announced Source revision 1
Original source ↗

CVE-2025-21756

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-21756

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
        "lessThan": "e7754d564579a5db9c5c9f74228df5d6dd6f1173",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
        "lessThan": "e48fcb403c2d0e574c19683f09399ab4cf67809c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
        "lessThan": "42b33381e5e1f2b967dc4fb4221ddb9aaf10d197",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
        "lessThan": "3f43540166128951cc1be7ab1ce6b7f05c670d8b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
        "lessThan": "645ce25aa0e67895b11d89f27bb86c9d444c40f8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
        "lessThan": "b1afd40321f1c243cffbcf40ea7ca41aca87fa5e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
        "lessThan": "fcdd2242c0231032fc84e1404315c245ae56322a",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/vmw_vsock/af_vsock.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.5"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.5",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.235",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.179",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.131",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.79",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.16",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.13.4",
        "versionType": "semver",
        "lessThanOrEqual": "6.13.*"
      },
      {
        "status": "unaffected",
        "version": "6.14",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/vmw_vsock/af_vsock.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-21756

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#26932 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement