CVE-2026-53181
vsock/vmci: fix sk_ack_backlog leak on failed handshake
Description
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix sk_ack_backlog leak on failed handshake When vmci_transport_recv_connecting_server() returns an error, vmci_transport_recv_listen() calls vsock_remove_pending() but never calls sk_acceptq_removed(). This leaves sk_ack_backlog incremented permanently. Repeated handshake failures (malformed packets, queue pair alloc failure, event subscribe failure) cause sk_ack_backlog to climb toward sk_max_ack_backlog. Once it reaches the limit the listener permanently refuses all new connections with -ECONNREFUSED, a silent denial of service requiring a process restart to recover. The two existing sk_acceptq_removed() calls in af_vsock.c do not cover this path: line 764 checks vsock_is_pending() which returns false after vsock_remove_pending(), and line 1889 is only reached on successful accept(). Fix by balancing sk_acceptq_added() with sk_acceptq_removed() on the error path.
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 6, 2026, 12:43 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Ensure sk_acceptq_removed() is called on error paths.
- Balance sk_acceptq_added() with sk_acceptq_removed().
- Apply the patch to the Linux kernel.
- Restart processes to recover from the service refusal.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53181.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53181 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53181
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53181 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53181 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 06, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-401 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.176 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.143 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.210 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.9 up to (excluding) 5.10.259 Added Reference Type kernel.org: https://git.kernel.org/stable/c/22c587aa3ab1ab5264daff3ec32136fd30436c13 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9698582a4dd9c4a05889d7db96d4c0edc9e69cac Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ba9ad6015937a5e46ba1a31370e3efdec8abbdcc Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/bcb275626055df7f8f947f1a349754b4004d9a15 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c05fa14db43ebef3bd862ca9d073981c0358b3f0 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/cf7090e255d74c4b61c51f8ede9fcacdd8393b5b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/dfd853197615d322d3a88dbcab91fc0fd2096219 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ea0b03d52881c12a8c634ea0d6cbfa61cefdb488 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'd021c344051af91f42c5ba9fdedc176740cbd238', 'lessThan': '22c587aa3ab1ab5264daff3ec32136fd30436c13', 'versionType': 'git'}, {'status': 'affected', 'version': 'd021c344051af91f42c5ba9fdedc176740cbd238', 'lessThan': 'cf7090e255d74c4b61c51f8ede9fcacdd8393b5b', 'versionType': 'git'}, {'status': 'affected', 'version': 'd021c344051af91f42c5ba9fdedc176740cbd238', 'lessThan': 'ea0b03d52881c12a8c634ea0d6cbfa61cefdb488', 'versionType': 'git'}, {'status': 'affected', 'version': 'd021c344051af91f42c5ba9fdedc176740cbd238', 'lessThan': 'dfd853197615d322d3a88dbcab91fc0fd2096219', 'versionType': 'git'}, {'status': 'affected', 'version': 'd021c344051af91f42c5ba9fdedc176740cbd238', 'lessThan': 'bcb275626055df7f8f947f1a349754b4004d9a15', 'versionType': 'git'}, {'status': 'affected', 'version': 'd021c344051af91f42c5ba9fdedc176740cbd238', 'lessThan': 'ba9ad6015937a5e46ba1a31370e3efdec8abbdcc', 'versionType': 'git'}, {'status': 'affected', 'version': 'd021c344051af91f42c5ba9fdedc176740cbd238', 'lessThan': '9698582a4dd9c4a05889d7db96d4c0edc9e69cac', 'versionType': 'git'}, {'status': 'affected', 'version': 'd021c344051af91f42c5ba9fdedc176740cbd238', 'lessThan': 'c05fa14db43ebef3bd862ca9d073981c0358b3f0', 'versionType': 'git'}], 'programFiles': ['net/vmw_vsock/vmci_transport.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.9'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.9', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/vmw_vsock/vmci_transport.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix sk_ack_backlog leak on failed handshake When vmci_transport_recv_connecting_server() returns an error, vmci_transport_recv_listen() calls vsock_remove_pending() but never calls sk_acceptq_removed(). This leaves sk_ack_backlog incremented permanently. Repeated handshake failures (malformed packets, queue pair alloc failure, event subscribe failure) cause sk_ack_backlog to climb toward sk_max_ack_backlog. Once it reaches the limit the listener permanently refuses all new connections with -ECONNREFUSED, a silent denial of service requiring a process restart to recover. The two existing sk_acceptq_removed() calls in af_vsock.c do not cover this path: line 764 checks vsock_is_pending() which returns false after vsock_remove_pending(), and line 1889 is only reached on successful accept(). Fix by balancing sk_acceptq_added() with sk_acceptq_removed() on the error path. Added Reference https://git.kernel.org/stable/c/22c587aa3ab1ab5264daff3ec32136fd30436c13 Added Reference https://git.kernel.org/stable/c/9698582a4dd9c4a05889d7db96d4c0edc9e69cac Added Reference https://git.kernel.org/stable/c/ba9ad6015937a5e46ba1a31370e3efdec8abbdcc Added Reference https://git.kernel.org/stable/c/bcb275626055df7f8f947f1a349754b4004d9a15 Added Reference https://git.kernel.org/stable/c/c05fa14db43ebef3bd862ca9d073981c0358b3f0 Added Reference https://git.kernel.org/stable/c/cf7090e255d74c4b61c51f8ede9fcacdd8393b5b Added Reference https://git.kernel.org/stable/c/dfd853197615d322d3a88dbcab91fc0fd2096219 Added Reference https://git.kernel.org/stable/c/ea0b03d52881c12a8c634ea0d6cbfa61cefdb488