In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpected packet type (err = -EINVAL). All destroy: arms now return err < 0, so vmci_transport_recv_listen() removes pending from pending_links synchronously and vsock_pending_work() takes the is_pending=false / !rejected branch, dropping only its own work reference. This also closes the multi-packet race Sashiko reported on v2: pending is removed from the list before any subsequent packet can find it. The pre-existing sk_acceptq_removed() gap on the err < 0 path of vmci_transport_recv_listen() that Sashiko also noted is not introduced or changed by this patch. Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server()     returned err = 0 for a peer RST in its default switch arm: err = pkt->type ==     VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip     vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state =     TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One     second later vsock_pending_work() observed is_pending=true and performed full cleanup:
    vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and
    __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in     refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events     vsock_pending_work Treat peer RST like any other unexpected packet type (err = -EINVAL). All destroy: arms     now return err < 0, so vmci_transport_recv_listen() removes pending from pending_links synchronously and     vsock_pending_work() takes the is_pending=false / !rejected branch, dropping only its own work reference.
    This also closes the multi-packet race Sashiko reported on v2: pending is removed from the list before any     subsequent packet can find it. The pre-existing sk_acceptq_removed() gap on the err < 0 path of     vmci_transport_recv_listen() that Sashiko also noted is not introduced or changed by this patch. Tested on     lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched. (CVE-2026-64115)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
333944	Photon OS 5.0: Linux PHSA-2026-5.0-92-0864	Nessus	PhotonOS Local Security Checks	high
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	high
327902	Linux Distros Unpatched Vulnerability : CVE-2026-64115	Nessus	Misc.	high
322107	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1894)	Nessus	Amazon Linux Local Security Checks	high
322088	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1882)	Nessus	Amazon Linux Local Security Checks	high
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	medium
322048	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-107 (ALASKERNEL-5.15-2026-107)	Nessus	Amazon Linux Local Security Checks	high
321988	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-123 (ALASKERNEL-5.10-2026-123)	Nessus	Amazon Linux Local Security Checks	high
318773	Photon OS 5.0: Linux PHSA-2026-5.0-0864	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2026-64115

high

Tenable Plugins

high

high

high

high

high

high

medium

high

high

high