CVE-2026-74613

A flaw was found in the Linux kernel's vsock/virtio component. A race condition during the teardown of the receive (RX) queue can allow work to add buffers after the virtual queues (virtqueues) have been deleted. This can lead to a use-after-free vulnerability, which may result in a kernel panic and a denial of service (DoS) to the system.

A moderate use-after-free flaw was found in the Linux kernel's vsock/virtio transport, which ships in Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel packages. When a virtio vsock device is torn down (for example during device removal or suspend/freeze), receive work that was queued across virtio_vsock_vqs_del() can still refill the RX queue after the underlying virtqueues have been deleted, causing a slab use-after-free in virtqueue_add_sgs that results in a kernel panic and a denial of service. Exploiting this race condition requires local access within a guest virtual machine that uses a virtio vsock device. Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with availability-only impact, which is lower than the upstream CVEORG score of 7.8 that assumes high confidentiality and integrity impact; no such impact is expected from this issue. Red Hat Enterprise Linux 6 and 7 are not affected because the code that introduced this issue (upstream commit b917507e5ad9) is not present in those streams. The affected Red Hat Enterprise Linux 8, 9, and 10 kernel and kernel-rt streams and the Red Hat In-Vehicle OS kernel streams are tracked with a deferred fix: given the narrow race window during device teardown, the local-only attack vector, and the denial-of-service-only consequence, the fix is planned for a future scheduled update rather than an immediate erratum. The residual risk is that a local user who can trigger and win this teardown race within a guest could crash that guest's kernel; confidentiality and integrity of the system are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.