PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46214 Linux CVE debrief

A logic error in the Linux kernel's virtio vsock transport causes the accept queue backlog counter to leak when transport assignment fails or selects a non-virtio transport. The vulnerability exists in virtio_transport_recv_listen(), which increments sk_ack_backlog via sk_acceptq_added() before validating the transport assignment. When vsock_assign_transport() fails or returns a different transport, the error path exits without decrementing the counter via sk_acceptq_removed(). After approximately backlog+1 such mismatches, sk_acceptq_is_full() returns true and the listener rejects all new connections, constituting a denial of service. The fix relocates sk_acceptq_added() to execute only after successful transport validation, aligning with the implementation patterns in vmci_transport and hyperv_transport. Multiple stable kernel branches received patches on 2026-05-28.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-10
Advisory published
2026-05-28
Advisory updated
2026-06-10

Who should care

Organizations running virtualized Linux workloads using virtio vsock for host-guest communication, particularly cloud providers and enterprises with KVM/QEMU-based virtualization infrastructure

Technical summary

The virtio vsock driver in the Linux kernel contains a logic flaw where sk_acceptq_added() is called before transport validation in virtio_transport_recv_listen(). If vsock_assign_transport() fails or selects an alternative transport, the error path omits sk_acceptq_removed(), causing permanent increment of sk_ack_backlog. This resource leak eventually fills the accept queue, forcing connection rejection. The vulnerability affects virtualized environments using virtio vsock for host-guest communication. Resolution involves reordering operations to validate transport before queue modification, consistent with other vsock transport implementations.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from distribution vendors containing the referenced stable branch commits
  • Monitor vendor security advisories for kernel package availability
  • Verify vsock listener functionality in virtualized environments after patching
  • Review application logs for connection rejection patterns that may indicate exploitation attempts

Evidence notes

Vulnerability description and fix details sourced from official CVE record and NVD entry published 2026-05-28. Kernel commit references confirm patch availability across stable branches. No CVSS score or severity assigned by source databases at time of publication.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46214 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46214

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46214 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46214

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/29371f3cc83e2a92265b4768014a30b80234112f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/52bcb57a4e8a0865a76c587c2451906342ae1b2d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/65c484726e74013a2ec7ba67a34d87760ae8f390

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6d3275fc4ed968938e1d556c344798046776668d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e9edf9893cf26d060705c910a9b62d8cc96ed56a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.