CVE-2026-80932 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess their exposure to this vulnerability and apply the patch from the Linux kernel stable branch.

Why it matters

This vulnerability can lead to a use-after-free error in the Linux kernel's virtio_vsock, potentially allowing an attacker to execute arbitrary code or cause a denial-of-service condition. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess their exposure to this vulnerability and apply the patch from the Linux kernel stable branch.

• Verify Linux kernel version and update to a patched version if necessary
• Assess exposure and apply the patch from the Linux kernel stable branch
• Monitor system logs for potential exploitation attempts

Technical summary

The Linux kernel's virtio_vsock is vulnerable to a use-after-free error. The flaw occurs due to a race condition between the removal of the virtio_vsock and the execution of its associated work items. Specifically, the `virtio_vsock_remove` function stops the virtqueues and then flushes each work item before freeing the enclosing `virtio_vsock`. However, the current order does not account for dependencies between those items: `tx_work` may queue `send_pkt_work`, and `send_pkt_work` may queue `rx_work`. This can lead to a use-after-free error when `kfree(vsock)` races with `rx_work`. The vulnerability was reported by KASAN, which detected a slab-use-after-free error in `virtio_transport_rx_work`. The error occurred when reading from an address that had already been freed. The flaw was resolved by flushing the works in producer-to-consumer order.

Defensive priority

High

Recommended defensive actions

• Assess exposure and apply the patch from the Linux kernel stable branch
• Verify the Linux kernel version and update to a patched version if necessary
• Monitor system logs for potential exploitation attempts
• Perform a thorough review of system configurations and apply compensating controls if necessary
• Track and inventory assets that may be affected by this vulnerability
• Consider implementing additional monitoring and detection measures for exposed assets
• Review and update incident response plans to address potential exploitation of this vulnerability

Evidence notes

The vulnerability was reported by KASAN, which detected a slab-use-after-free error in `virtio_transport_rx_work`. The error occurred when reading from an address that had already been freed. The flaw was resolved by flushing the works in producer-to-consumer order.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.