CVE-2024-53118

A flaw was found in the Linux kernel's Virtual Socket (vsock) implementation. When zero-copy data transfers are used, completion notifications placed on a socket's error queue are not cleared when the socket is closed. A local user can exploit this flaw to trigger an uncollected memory leak, potentially leading to system memory exhaustion and a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent autoloading of the vsock kernel module on systems where virtual machine socket communication is not required.

To prevent the vsock module from loading, run the following commands as root:

echo "blacklist vsock" >> /etc/modprobe.d/disable-vsock.conf

echo "install vsock /bin/true" >> /etc/modprobe.d/disable-vsock.conf

If the module is already loaded in memory, a system restart is required for changes to take effect. Disabling this module prevents communication between virtual machines and the host hypervisor over the VSOCK address family, which may disrupt guest integration daemons and services.