CVE-2026-98947 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
During the closure of a datagram socket, the vmci_transport_recv_dgram_cb() function may be called, which will add the packets to the socket's backlog; then, after the receive queue is cleared, the __release_sock() function will move the packet back from the socket's backlog to the receive queue, which will lead to a memory leak.
sock_close __sock_release __vsock_release // take ownership by user-space lock_sock_nested sock_set_flag(sk, SOCK_DEAD) vmci_transport_release vmci_dispatch_dgs vmci_datagram_invoke_guest_handler vmci_transport_recv_dgram_cb sk_receive_skb if (!sock_owned_by_user(sk)) [...]
(!) else if sk_add_backlog() [...]
(!) skb_queue_purge(&sk->sk_receive_queue)
release_sock __release_sock // move all packets from the backlog // to the receive queue (!) sk_backlog_rcv vsock_queue_rcv_skb [...]
__sock_queue_rcv_skb if (!sock_flag(sk, SOCK_DEAD)) // Since the socket is "dead", the function will not // be called sk->sk_data_ready(sk) sock_release_ownership(sk); sock_put
Add a receive queue cleanup in the socket destructor to fix this.
syzkaller report:
unreferenced object 0xffff8880117bfb80 (size 240): comm "irq/56-vmw_vmci", pid 205, jiffies 4295064448 (age 73.992s) hex dump (first 32 bytes): 78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.&.....x.&..... 00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........&..... backtrace: [<ffffffff82be8d97>] __alloc_skb+0x287/0x330 net/core/skbuff.c:505
[<ffffffffa114bcbd>] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport]
[<ffffffffa05072c6>] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci]
[<ffffffffa050ad75>] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci]
[<ffffffffa050b025>] vmci_interrupt+0x55/0x290 [vmw_vmci]
[<ffffffff8137ad2b>] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205
[<ffffffff8137c7ae>] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314
[<ffffffff81253dd6>] kthread+0x2e6/0x3a0 kernel/kthread.c:376
[<ffffffff81004392>] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified vulnerability resides within the Virtual Socket VMCI transport implementation in the Linux kernel, specifically affecting the datagram socket handling logic during resource release. This issue manifests as a memory leak that occurs when closing or releasing a datagram socket associated with VMware's Virtual Machine Communication Interface. The root cause lies in an improper sequence of operations involving packet queuing and queue purging within the socket destructor path. When a user-space application closes a VMCI datagram socket, the kernel initiates the release process by marking the socket as dead and invoking transport-specific cleanup routines. During this phase, incoming packets may still be processed via interrupt handlers or asynchronous callbacks before the final teardown is complete.
The technical flaw arises from how received sk_buff structures are handled in vmci_transport_recv_dgram_cb when invoked during the socket closure sequence. If a packet arrives while the socket lock is held by another context but not yet released, it gets added to the socket's backlog queue via sk_add_backlog rather than being immediately processed and freed. Subsequently, as part of the normal socket release procedure, __release_sock is called which moves all pending packets from the backlog back into the receive queue. However, because the socket has already been marked as dead, these moved packets are not properly consumed or freed by standard data ready callbacks. Instead, they remain in a state where they are no longer accessible to user space but also not explicitly deallocated by the kernel's cleanup routines for that specific transport layer, resulting in unreferenced memory objects persisting after socket closure.
This vulnerability is classified under CWE-401, which describes missing release of memory after effective lifetime, and aligns with ATT&CK technique T1537 if considered part of a broader resource exhaustion attack vector aimed at degrading system stability through denial-of-service conditions. The operational impact primarily involves gradual degradation of kernel memory resources over time on systems utilizing VMCI datagram sockets extensively. While individual leaks may appear small, repeated exploitation or high-frequency socket churn can lead to significant memory pressure, potentially triggering out-of-memory killers or causing instability in virtualized environments where such transports are commonly used for inter-VM communication.
The fix implemented addresses this by ensuring that the receive queue is explicitly purged within the socket destructor path after backlog processing has occurred but before final release completes. This guarantees that any packets lingering in either the main receive queue or the backlog queue due to race conditions during closure are properly freed. The solution was verified using Syzkaller, a powerful fuzzing tool for Linux kernels, which successfully reproduced the unreferenced object condition described in the initial report from InfoTeCS and the Linux Verification Center. System administrators should ensure their kernel versions include this patch to prevent potential memory leaks associated with VMCI datagram socket lifecycle management.