{"id":"CVE-2026-99122","kind":"vulnerability","aliases":["CVE-2026-99122"],"related":[],"title":"Linux kernel: VMware VMCI socket accepts packets from wrong peer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: validate packet source for connected sockets\n\nvmci_transport_recv_stream_cb() looks up sockets first by the full source\nand destination tuple, then by destination only in the bound table. The\nfallback can select a non-listening socket without checking whether the\npacket came from its stored peer.\n\nThis was reproduced with two VMCI contexts. A RST from the context not\nstored in a TCP_SYN_SENT socket reset that socket after it was selected by\nthe destination-only lookup.\n\nVMCI can process notification packets in bottom-half context when the\nsocket is not owned by user context, or defer packets to a workqueue. Use\nvsock_check_source() after taking the socket lock in the bottom-half path,\nand recheck after lock_sock() in the workqueue path. Listening sockets\ncontinue to accept packets from any source.\n\nReply with a RST addressed from the received packet before dropping a\nsource that fails validation. This preserves the existing reset behavior\nfor bound non-listening and concurrently closed sockets without directing\nthe reset to a connected socket's stored peer.","summary":"The Linux kernel's VMCI vsock transport looked up connected sockets by destination only, so a packet from a different context could reset or affect a connected socket. An attacker on a VMCI-connected context may be able to reset a victim's socket.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","vmware","vsock"],"not_affected_if":["no-vmci-transport","non-vmware-hypervisor"],"how_to_check":"- Check the running kernel with `uname -r` and whether the `vmw_vmci` and `vsock` modules are loaded with `lsmod | grep -E 'vmw_vmci|vsock'`\n- Compare the kernel build against the fixed stable release listed in the kernel git commit for this CVE (unknown in the sources)","fix":"- Update the Linux kernel to a stable release containing the upstream fix (fixed version: unknown in the sources)\n- Reboot into the patched kernel after the update","status":"open","published_at":"2026-10-28T11:17:31+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:33+00:00","updated_at":"2026-10-28T11:37:33+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-28T11:37:33Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release containing the upstream fix (fixed version: unknown in the sources)\n- Reboot into the patched kernel after the update","reach":"local","title":"Linux kernel: VMware VMCI socket accepts packets from wrong peer","impact":"low","summary":"The Linux kernel's VMCI vsock transport looked up connected sockets by destination only, so a packet from a different context could reset or affect a connected socket. An attacker on a VMCI-connected context may be able to reset a victim's socket.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","vmware","vsock"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A peer context can reset or disrupt a connected VMCI vsock socket","analyst_note":"Find the fixed kernel versions and affected stable branches in the NVD entry or the kernel git commit for this CVE.","how_to_check":"- Check the running kernel with `uname -r` and whether the `vmw_vmci` and `vsock` modules are loaded with `lsmod | grep -E 'vmw_vmci|vsock'`\n- Compare the kernel build against the fixed stable release listed in the kernel git commit for this CVE (unknown in the sources)","needs_analyst":true,"not_affected_if":["no-vmci-transport","non-vmware-hypervisor"],"who_is_affected":"Only hosts that run the Linux kernel with the VMCI transport in use, typically VMware virtual machines that use vsock over VMCI. Systems without the vmw_vmci and vsock modules loaded are unlikely to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00066,"input_tokens":3581,"output_tokens":603,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99122':13A,16A 'abl':61B 'accept':6A,214C 'address':223C 'affect':47B 'attack':52B 'behavior':240C 'bottom':168C,198C 'bottom-half':167C,197C 'bound':107C,242C 'came':123C 'cb':89C 'check':119C,188C 'close':248C 'concurr':247C 'connect':32B,49B,57B,83C,256C 'context':43B,58B,134C,139C,170C,179C 'continu':212C 'could':44B 'cve':11A,14A 'defer':181C 'destin':35B,99C,103C,158C 'destination-on':157C 'differ':42B 'direct':251C 'drop':229C 'exist':238C 'fail':233C 'fallback':110C 'first':93C 'follow':73C 'full':96C 'half':169C,199C 'kernel':2A,19B,25B,71C 'linux':1A,18B,24B,70C 'linux-kernel':17B 'listen':116C,210C,245C 'lock':194C,204C 'look':30B,90C 'lookup':160C 'may':59B 'non':115C,244C 'non-listen':114C,243C 'notif':164C 'own':176C 'packet':7A,39B,80C,122C,165C,182C,215C,227C 'path':200C,209C 'peer':10A,127C,260C 'preserv':236C 'process':163C 'receiv':226C 'recheck':202C 'recv':87C 'repli':219C 'reproduc':130C 'reset':45B,63B,148C,239C,253C 'resolv':77C 'rst':136C,222C 'runtim':20B 'select':112C,154C 'sent':146C 'sock':205C 'socket':5A,33B,50B,67B,84C,92C,117C,147C,150C,173C,193C,211C,249C,257C 'sourc':81C,97C,189C,218C,231C 'store':126C,141C,259C 'stream':88C 'syn':145C 'tabl':108C 'take':191C 'tcp':144C 'transport':29B,86C 'tupl':100C 'two':132C 'use':186C 'user':178C 'valid':79C,234C 'victim':65B 'vmci':4A,27B,56B,85C,133C,161C 'vmci-connect':55B 'vmware':3A,21B 'vsock':22B,28B,187C 'vsock/vmci':78C 'vulner':74C 'whether':120C 'without':118C,250C 'workqueu':185C,208C 'wrong':9A","nicknames":[],"mitigations":[],"who_affected":"Only hosts that run the Linux kernel with the VMCI transport in use, typically VMware virtual machines that use vsock over VMCI. Systems without the vmw_vmci and vsock modules loaded are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99122","severity":null,"published_at":"2026-10-28T11:17:31+00:00","modified_at":"2026-10-28T11:17:31+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}