Cloudanix VulnDB

CVE-2026-98947

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux can cause memory to slowly leak away during certain virtual machine connection closures, potentially leading to slowdowns if left unfixed.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Memory leak of skb buffers in vmci_transport_recv_dgram_cb during datagram socket closure when packets are added to backlog then moved back to a purged receive queue without being freed.

Why it matters to the business

Gradual memory exhaustion on Linux systems using VMCI vsock datagrams can degrade performance or cause denial of service over time; low urgency due to no known exploitation and minimal EPSS.

How an attack unfolds

An attacker interacts with VMCI datagram sockets to trigger the recv_dgram_cb path while forcing socket closure and receive queue purge, leaving skbs allocated and unreferenced as shown in the syzkaller trace.

How to fix it

Apply the upstream kernel fix adding receive queue cleanup in the socket destructor; rebuild and deploy updated kernel images to affected systems.

How to confirm the fix worked

Confirm presence of the destructor cleanup patch in the kernel source or binary; monitor slabinfo or kmemleak for unreferenced vmci skb objects after socket operations.

Typical attack path

  1. Create and use vsock datagram socket over VMCI
  2. Trigger vmci_transport_recv_dgram_cb while socket is user-owned
  3. Close socket causing skb_queue_purge and backlog move
  4. Observe unreleased skb objects accumulating in memory

How to detect it

Inspect kernel logs and syzkaller-style traces for vmci_transport_recv_dgram_cb backtraces; use kmemleak reports or slab accounting to identify unreferenced 240-byte skb objects from irq/ vmw_vmci threads.

What your security team should do

  • Prioritize kernel updates on systems exposing VMCI vsock interfaces within the next maintenance window
  • Enable kmemleak or similar kernel memory debugging in test environments to validate absence of the leak
  • Review vsock usage in virtualization setups and restrict datagram sockets where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmci_transport_recv_dgram_cb() During the closure of a datagram socket, the vmci_transport_recv_dgram_cb() function may be called, which will add the packets to the socket's backlog; then, after the receive queue is cleared, the __release_sock() function will move the packet back from the socket's backlog to the receive queue, which will lead to a memory leak. sock_close __sock_release __vsock_release // take ownership by user-space lock_sock_nested sock_set_flag(sk, SOCK_DEAD) vmci_transport_release vmci_dispatch_dgs vmci_datagram_invoke_guest_handler vmci_transport_recv_dgram_cb sk_receive_skb if (!sock_owned_by_user(sk)) [...] (!) else if sk_add_backlog() [...] (!) skb_queue_purge(&sk->sk_receive_queue) release_sock __release_sock // move all packets from the backlog // to the receive queue (!) sk_backlog_rcv vsock_queue_rcv_skb [...] __sock_queue_rcv_skb if (!sock_flag(sk, SOCK_DEAD)) // Since the socket is "dead", the function will not // be called sk->sk_data_ready(sk) sock_release_ownership(sk); sock_put Add a receive queue cleanup in the socket destructor to fix this. syzkaller report: unreferenced object 0xffff8880117bfb80 (size 240): comm "irq/56-vmw_vmci", pid 205, jiffies 4295064448 (age 73.992s) hex dump (first 32 bytes): 78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.&.....x.&..... 00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........&..... backtrace: [<ffffffff82be8d97>] __alloc_skb+0x287/0x330 net/core/skbuff.c:505 [<ffffffffa114bcbd>] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport] [<ffffffffa05072c6>] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci] [<ffffffffa050ad75>] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci] [<ffffffffa050b025>] vmci_interrupt+0x55/0x290 [vmw_vmci] [<ffffffff8137ad2b>] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205 [<ffffffff8137c7ae>] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314 [<ffffffff81253dd6>] kthread+0x2e6/0x3a0 kernel/kthread.c:376 [<ffffffff81004392>] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295 Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller.

Affected packages

Ecosystem Package Introduced Fixed