CVE-2026-80932

A flaw was found in the Linux kernel, specifically within the vsock/virtio component. An incorrect order of flushing work items during the removal of a virtio_vsock object can lead to a use-after-free condition. This vulnerability allows a race condition where memory can be freed while still in use, potentially resulting in memory corruption and system instability or a denial of service.

A MODERATE-severity use-after-free flaw was found in the Linux kernel vsock/virtio transport. When a virtio_vsock device is removed, virtio_vsock_remove() flushes its work items in an order that does not account for dependencies between them: tx_work may queue send_pkt_work, and send_pkt_work may in turn queue rx_work. If rx_work is flushed before send_pkt_work queues it again, nothing waits for the newly queued rx_work before the virtio_vsock object is freed, so kfree(vsock) can race with the still-running rx_work. This race can result in a slab use-after-free (as reported by KASAN), leading to memory corruption and a kernel crash or denial of service. Exploitation requires local privileged access to trigger removal of a virtio_vsock device, which limits the practical impact to system availability.

The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10 and the RHCOS kernels shipped with OpenShift Container Platform 4 are marked affected. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream. For the affected streams the fix is deferred: the flaw is rated MODERATE with a Red Hat CVSS 3.1 score of 5.5, below the threshold at which Red Hat files trackers for MODERATE kernel flaws without a higher CVSS score. The residual risk of deferral is a local denial of service through memory corruption during virtio_vsock device removal. The CVE.org score of 8.4 is higher than Red Hat's 5.5 mainly because Red Hat assesses that local privileges are required to trigger the device removal (PR:L) and that the security impact is limited to availability (C:N/I:N/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.