CVE-2025-38618

A flaw was found in the Linux kernel's vsock (virtual socket) subsystem. A local user can trigger this issue by binding a socket to an automatic port identifier, which leads to improper reference counting during connection handling. This flaw results in a use-after-free condition, allowing a local attacker to cause a kernel crash and a Denial of Service (DoS), or potentially execute arbitrary code.

A logic flaw allowed AF_VSOCK sockets to be bound to VMADDR_PORT_ANY, which could leave accepted sockets in an inconsistent state and trigger a refcount mismatch, leading to a use-after-free in the vsock core. A local unprivileged program can reach this via normal socket APIs (bind/accept), causing a kernel crash (denial of service). The fix disallows binding to VMADDR_PORT_ANY in __vsock_bind_connectible(), preventing the erroneous lifecycle path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.