CVE-2026-74614vsock/virtio: read virtqueues under worker locks
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker locks Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's running state while retaining a pointer to the deleted queue. Read each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.
- CVSS
- 8.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 762c251c7f5c4ee5bef71460c6e822ed293fd69f before 941329ce14c5f481223a10d1d4c8b57ea7f3048a; from bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before 29dd10583bf9d2744cd84b862e4257c0a5699570; from bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before a1fb0c5b8a7c2753758aeced40971f99449dde0c; from bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before eae099c764c7ebdb842eb1f638913e310bdd6513; from bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before bd43a7ec668be428265b3209eb43647aedcf720a; from bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before 1cecb4202afdbeddcf29d59baf596ac6ab753f7f; from bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c before ebac8f6b1ef0e9278afe204b8692a7479988dace; from 5.15.138 before 5.15.216 | CNA record |
References
- https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a
- https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570
- https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c
- https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513
- https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a
- https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f
- https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.