Live › vulnerability › CVE-2026-99122
Go to dashboardThe Linux kernel's VMCI vsock transport looked up connected sockets by destination only, so a packet from a different context could reset or affect a connected socket. An attacker on a VMCI-connected context may be able to reset a victim's socket.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Only hosts that run the Linux kernel with the VMCI transport in use, typically VMware virtual machines that use vsock over VMCI. Systems without the vmw_vmci and vsock modules loaded are unlikely to be affected.
No product ranges from the sources yet.
uname -r and whether the vmw_vmci and vsock modules are loaded with lsmod | grep -E 'vmw_vmci|vsock'Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
vsock/vmci: validate packet source for connected sockets
vmci_transport_recv_stream_cb() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a non-listening socket without checking whether the packet came from its stored peer.
This was reproduced with two VMCI contexts. A RST from the context not stored in a TCP_SYN_SENT socket reset that socket after it was selected by the destination-only lookup.
VMCI can process notification packets in bottom-half context when the socket is not owned by user context, or defer packets to a workqueue. Use vsock_check_source() after taking the socket lock in the bottom-half path, and recheck after lock_sock() in the workqueue path. Listening sockets continue to accept packets from any source.
Reply with a RST addressed from the received packet before dropping a source that fails validation. This preserves the existing reset behavior for bound non-listening and concurrently closed sockets without directing the reset to a connected socket's stored peer.
This page as .md · .json · in your agent: get_signal("CVE-2026-99122")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.