Cloudanix VulnDB

CVE-2026-99123

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of virtual machine socket connections could let one program receive data meant for another, potentially leaking information between virtual machines.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing source address validation in virtio_transport_recv_pkt() fallback lookup allows RESPONSE packets from unrelated sources to transition a TCP_SYN_SENT socket to TCP_ESTABLISHED and deliver subsequent RW packets to the wrong connected socket.

Why it matters to the business

In virtualized environments using virtio-vsock, an attacker with local unprivileged access can inject data into another process's socket or cause it to read attacker-controlled bytes, risking information leakage or communication integrity between guests and hosts.

How an attack unfolds

An attacker with unprivileged access enumerates target vsock tuples via AF_VSOCK sock_diag, sends a crafted RESPONSE from an unrelated source CID/port to force state transition, then delivers RW packets that the victim socket accepts and reads while the legitimate peer receives nothing.

How to fix it

Apply the upstream kernel patch that introduces vsock_check_source() validation after lock_sock() in the virtio receive path; rebuild and deploy updated kernels across all affected hosts and guests.

How to confirm the fix worked

Verify the vsock_check_source() helper is present and invoked after lock_sock() in virtio_transport_recv_pkt(); attempt reproduction with cross-CID RESPONSE packets to confirm state transitions are rejected.

Typical attack path

  1. Use unprivileged AF_VSOCK sock_diag to discover target socket tuple
  2. Transmit malicious RESPONSE packet from unrelated source CID and port
  3. Send follow-on RW packets containing chosen payload
  4. Victim socket accepts data and transitions to established state

How to detect it

Review kernel logs for unexpected vsock socket state transitions or source mismatches; monitor for unusual sock_diag queries followed by cross-CID packet activity; inspect virtio transport receive paths for missing source checks in running kernels.

What your security team should do

  • Prioritize kernel updates within the next maintenance window given one-day public disclosure
  • Audit systems exposing AF_VSOCK for least-privilege restrictions on sock_diag and vsock access
  • Add kernel build and boot-time checks for the new validation helper in CI pipelines

The record

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening and connecting sockets, but sockets remain in the bound table after connect(), so it can also return a non-listening socket. The fallback does not validate the source address. In TCP_SYN_SENT, a RESPONSE from an unrelated source can transition the victim socket to TCP_ESTABLISHED while its stored remote address remains unchanged. Subsequent RW packets from that source are delivered through the same destination-only fallback. This was reproduced with capability-empty processes under different UIDs. The attacker discovered the target tuple through unprivileged AF_VSOCK sock_diag and caused the victim socket to read 16 attacker-chosen bytes; the intended peer-side socket read 0 of those 16 bytes. Add vsock_check_source() to validate the transport, source port and source CID against the peer stored in a non-listening socket. The local transport is the CID exception because its packets are generated internally with VMADDR_CID_LOCAL as their source, including connections using CID aliases. Use the helper after lock_sock() in the virtio receive path.

Affected packages

Ecosystem Package Introduced Fixed