CVE-2026-98947

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98947", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.381Z", "datePublished": "2026-10-23T12:19:06.146Z", "dateUpdated": "2026-10-23T12:19:06.146Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T12:19:06.146Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Fix memory leak in vmci_transport_recv_dgram_cb()\n\nDuring the closure of a datagram socket, the vmci_transport_recv_dgram_cb()\nfunction may be called, which will add the packets\nto the socket's backlog; then, after the receive queue is cleared,\nthe __release_sock() function will move the packet back from the socket's\nbacklog to the receive queue, which will lead to a memory leak.\n\nsock_close\n __sock_release\n __vsock_release\n // take ownership by user-space\n lock_sock_nested\n sock_set_flag(sk, SOCK_DEAD)\n vmci_transport_release\n vmci_dispatch_dgs\n vmci_datagram_invoke_guest_handler\n vmci_transport_recv_dgram_cb\n sk_receive_skb\n if (!sock_owned_by_user(sk))\n [...]\n (!) else if sk_add_backlog()\n [...]\n (!) skb_queue_purge(&sk->sk_receive_queue)\n\n release_sock\n __release_sock\n // move all packets from the backlog\n // to the receive queue\n (!) sk_backlog_rcv\n vsock_queue_rcv_skb\n [...]\n __sock_queue_rcv_skb\n if (!sock_flag(sk, SOCK_DEAD))\n // Since the socket is \"dead\", the function will not\n // be called\n sk->sk_data_ready(sk)\n sock_release_ownership(sk);\n sock_put\n\nAdd a receive queue cleanup in the socket destructor to fix this.\n\nsyzkaller report:\n\nunreferenced object 0xffff8880117bfb80 (size 240):\n comm \"irq/56-vmw_vmci\", pid 205, jiffies 4295064448 (age 73.992s)\n hex dump (first 32 bytes):\n 78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.&.....x.&.....\n 00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........&.....\n backtrace:\n [<ffffffff82be8d97>] __alloc_skb+0x287/0x330 net/core/skbuff.c:505\n [<ffffffffa114bcbd>] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport]\n [<ffffffffa05072c6>] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci]\n [<ffffffffa050ad75>] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci]\n [<ffffffffa050b025>] vmci_interrupt+0x55/0x290 [vmw_vmci]\n [<ffffffff8137ad2b>] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205\n [<ffffffff8137c7ae>] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314\n [<ffffffff81253dd6>] kthread+0x2e6/0x3a0 kernel/kthread.c:376\n [<ffffffff81004392>] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/vmw_vsock/af_vsock.c"], "versions": [{"version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "0f8e2b2045355a0ee2008125e573435504b13cee", "status": "affected", "versionType": "git"}, {"version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "4835dbcde5cc3ae37e0d0796052056b35fcae8bf", "status": "affected", "versionType": "git"}, {"version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "9907db2b8e7ba70b442bb9dec86526a6511fac62", "status": "affected", "versionType": "git"}, {"version": "d021c344051af91f42c5ba9fdedc176740cbd238", "lessThan": "7c24a4e87e219072e5e106f6791146cbf3b056b3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/vmw_vsock/af_vsock.c"], "versions": [{"version": "3.9", "status": "affected"}, {"version": "0", "lessThan": "3.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.9", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0f8e2b2045355a0ee2008125e573435504b13cee"}, {"url": "https://git.kernel.org/stable/c/4835dbcde5cc3ae37e0d0796052056b35fcae8bf"}, {"url": "https://git.kernel.org/stable/c/9907db2b8e7ba70b442bb9dec86526a6511fac62"}, {"url": "https://git.kernel.org/stable/c/7c24a4e87e219072e5e106f6791146cbf3b056b3"}], "title": "vsock: Fix memory leak in vmci_transport_recv_dgram_cb()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/vmw_vsock/af_vsock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0f8e2b2045355a0ee2008125e573435504b13cee", "status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "versionType": "git"}, {"lessThan": "4835dbcde5cc3ae37e0d0796052056b35fcae8bf", "status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "versionType": "git"}, {"lessThan": "9907db2b8e7ba70b442bb9dec86526a6511fac62", "status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "versionType": "git"}, {"lessThan": "7c24a4e87e219072e5e106f6791146cbf3b056b3", "status": "affected", "version": "d021c344051af91f42c5ba9fdedc176740cbd238", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/vmw_vsock/af_vsock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.9"}, {"lessThan": "3.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: Fix memory leak in vmci_transport_recv_dgram_cb()\n\nDuring the closure of a datagram socket, the vmci_transport_recv_dgram_cb()\nfunction may be called, which will add the packets\nto the socket's backlog; then, after the receive queue is cleared,\nthe __release_sock() function will move the packet back from the socket's\nbacklog to the receive queue, which will lead to a memory leak.\n\nsock_close\n __sock_release\n __vsock_release\n // take ownership by user-space\n lock_sock_nested\n sock_set_flag(sk, SOCK_DEAD)\n vmci_transport_release\n vmci_dispatch_dgs\n vmci_datagram_invoke_guest_handler\n vmci_transport_recv_dgram_cb\n sk_receive_skb\n if (!sock_owned_by_user(sk))\n [...]\n (!) else if sk_add_backlog()\n [...]\n (!) skb_queue_purge(&sk->sk_receive_queue)\n\n release_sock\n __release_sock\n // move all packets from the backlog\n // to the receive queue\n (!) sk_backlog_rcv\n vsock_queue_rcv_skb\n [...]\n __sock_queue_rcv_skb\n if (!sock_flag(sk, SOCK_DEAD))\n // Since the socket is \"dead\", the function will not\n // be called\n sk->sk_data_ready(sk)\n sock_release_ownership(sk);\n sock_put\n\nAdd a receive queue cleanup in the socket destructor to fix this.\n\nsyzkaller report:\n\nunreferenced object 0xffff8880117bfb80 (size 240):\n comm \"irq/56-vmw_vmci\", pid 205, jiffies 4295064448 (age 73.992s)\n hex dump (first 32 bytes):\n 78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.&.....x.&.....\n 00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........&.....\n backtrace:\n [<ffffffff82be8d97>] __alloc_skb+0x287/0x330 net/core/skbuff.c:505\n [<ffffffffa114bcbd>] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport]\n [<ffffffffa05072c6>] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci]\n [<ffffffffa050ad75>] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci]\n [<ffffffffa050b025>] vmci_interrupt+0x55/0x290 [vmw_vmci]\n [<ffffffff8137ad2b>] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205\n [<ffffffff8137c7ae>] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314\n [<ffffffff81253dd6>] kthread+0x2e6/0x3a0 kernel/kthread.c:376\n [<ffffffff81004392>] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller."}], "id": "CVE-2026-98947", "lastModified": "2026-10-23T13:17:15.760", "metrics": {}, "published": "2026-10-23T13:17:15.760", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f8e2b2045355a0ee2008125e573435504b13cee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4835dbcde5cc3ae37e0d0796052056b35fcae8bf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7c24a4e87e219072e5e106f6791146cbf3b056b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9907db2b8e7ba70b442bb9dec86526a6511fac62"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via memory leak in vsock VMCI datagram handling", "id": "2559637", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559637"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvsock: Fix memory leak in vmci_transport_recv_dgram_cb()\nDuring the closure of a datagram socket, the vmci_transport_recv_dgram_cb()\nfunction may be called, which will add the packets\nto the socket's backlog; then, after the receive queue is cleared,\nthe __release_sock() function will move the packet back from the socket's\nbacklog to the receive queue, which will lead to a memory leak.\nsock_close\n__sock_release\n__vsock_release\n// take ownership by user-space\nlock_sock_nested\nsock_set_flag(sk, SOCK_DEAD)\nvmci_transport_release\nvmci_dispatch_dgs\nvmci_datagram_invoke_guest_handler\nvmci_transport_recv_dgram_cb\nsk_receive_skb\nif (!sock_owned_by_user(sk))\n[...]\n(!) else if sk_add_backlog()\n[...]\n(!) skb_queue_purge(&sk->sk_receive_queue)\nrelease_sock\n__release_sock\n// move all packets from the backlog\n// to the receive queue\n(!) sk_backlog_rcv\nvsock_queue_rcv_skb\n[...]\n__sock_queue_rcv_skb\nif (!sock_flag(sk, SOCK_DEAD))\n// Since the socket is \"dead\", the function will not\n// be called\nsk->sk_data_ready(sk)\nsock_release_ownership(sk);\nsock_put\nAdd a receive queue cleanup in the socket destructor to fix this.\nsyzkaller report:\nunreferenced object 0xffff8880117bfb80 (size 240):\ncomm \"irq/56-vmw_vmci\", pid 205, jiffies 4295064448 (age 73.992s)\nhex dump (first 32 bytes):\n78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.&.....x.&.....\n00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........&.....\nbacktrace:\n[<ffffffff82be8d97>] __alloc_skb+0x287/0x330 net/core/skbuff.c:505\n[<ffffffffa114bcbd>] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport]\n[<ffffffffa05072c6>] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci]\n[<ffffffffa050ad75>] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci]\n[<ffffffffa050b025>] vmci_interrupt+0x55/0x290 [vmw_vmci]\n[<ffffffff8137ad2b>] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205\n[<ffffffff8137c7ae>] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314\n[<ffffffff81253dd6>] kthread+0x2e6/0x3a0 kernel/kthread.c:376\n[<ffffffff81004392>] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller.", "A flaw was found in the Linux kernel's Virtual Sockets (vsock) subsystem during Virtual Machine Communication Interface (VMCI) datagram socket closure. When closing a datagram socket, incoming packets added to the socket's backlog can be moved back to the receive queue without proper cleanup. A local attacker could exploit this flaw to continuously leak kernel memory, potentially leading to resource exhaustion and a Denial of Service (DoS)."], "name": "CVE-2026-98947", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T12:19:06Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98947\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98947\nhttps://git.kernel.org/stable/c/0f8e2b2045355a0ee2008125e573435504b13cee\nhttps://git.kernel.org/stable/c/4835dbcde5cc3ae37e0d0796052056b35fcae8bf\nhttps://git.kernel.org/stable/c/7c24a4e87e219072e5e106f6791146cbf3b056b3\nhttps://git.kernel.org/stable/c/9907db2b8e7ba70b442bb9dec86526a6511fac62"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,0f8e2b2045355a0ee2008125e573435504b13cee)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,4835dbcde5cc3ae37e0d0796052056b35fcae8bf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,9907db2b8e7ba70b442bb9dec86526a6511fac62)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,7c24a4e87e219072e5e106f6791146cbf3b056b3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,0f8e2b2045355a0ee2008125e573435504b13cee)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,4835dbcde5cc3ae37e0d0796052056b35fcae8bf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,9907db2b8e7ba70b442bb9dec86526a6511fac62)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d021c344051af91f42c5ba9fdedc176740cbd238,7c24a4e87e219072e5e106f6791146cbf3b056b3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T16:45:17.362222+00:00", "updated": "2026-10-29T14:00:17.121546+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-401", "CWE-772"]}