CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown

CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: avoid refilling the RX queue after teardown

Commit b917507e5ad9 ("vsock/virtio: stop workers during the .remove()")
made the RX worker jump to its common exit when rx_run is clear.  That
exit still refills the RX queue when the buffer count is low, so work
queued across virtio_vsock_vqs_del() can add buffers after the virtqueues
have been deleted.

BUG: KASAN: slab-use-after-free in virtqueue_add_sgs
Read of size 4 by task kworker/0:1
Workqueue: virtio_vsock virtio_transport_rx_work
Call Trace:
 virtqueue_add_sgs (drivers/virtio/virtio_ring.c:2796)
 virtio_vsock_rx_fill (net/vmw_vsock/virtio_transport.c:332)
 virtio_transport_rx_work (net/vmw_vsock/virtio_transport.c:701)
 process_one_work (kernel/workqueue.c:3314)
 worker_thread (kernel/workqueue.c:3478)
 kthread (kernel/kthread.c:436)
 ret_from_fork (arch/x86/kernel/process.c:158)
 ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
...
Freed by task 141:
 kfree (mm/slub.c:6566)
 vp_del_vq (drivers/virtio/virtio_pci_common.c:259)
 vp_del_vqs (drivers/virtio/virtio_pci_common.c:285)
 virtio_vsock_freeze (net/vmw_vsock/virtio_transport.c:912)
 virtio_device_freeze (drivers/virtio/virtio.c:658)
 virtio_pci_freeze (drivers/virtio/virtio_pci_common.c:601)
 pci_pm_freeze (drivers/pci/pci-driver.c:1098)
 device_suspend (drivers/base/power/main.c:1968)
Kernel panic - not syncing: KASAN: panic_on_warn set ...

Jump to a no-refill exit when rx_run is clear, leaving the normal exit
to replenish a running queue.

The Linux kernel CVE team has assigned CVE-2026-74613 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.3 with commit b917507e5ad983085d29069369778b16aa03a0a8 and fixed in 5.10.265 with commit a7658508f5fe8f1077a65e8cb9535d3426f37a2f
	Issue introduced in 5.3 with commit b917507e5ad983085d29069369778b16aa03a0a8 and fixed in 5.15.216 with commit 1aa21e7c8702a7c37cd7d3cace1a652cfa5e8171
	Issue introduced in 5.3 with commit b917507e5ad983085d29069369778b16aa03a0a8 and fixed in 6.1.183 with commit 4d37e3525cc346a1421c1bdeaad5848e249fc60c
	Issue introduced in 5.3 with commit b917507e5ad983085d29069369778b16aa03a0a8 and fixed in 6.6.152 with commit 9d80a04129a6c27a690cb69de3fe3f50be5aa8b9
	Issue introduced in 5.3 with commit b917507e5ad983085d29069369778b16aa03a0a8 and fixed in 6.12.104 with commit a309b74e3fc052352ab778500449cb9c3853c363
	Issue introduced in 5.3 with commit b917507e5ad983085d29069369778b16aa03a0a8 and fixed in 6.18.45 with commit 38c7763fdc533edb34dc8f4489c260e8ba2ccae9
	Issue introduced in 5.3 with commit b917507e5ad983085d29069369778b16aa03a0a8 and fixed in 7.1.9 with commit e82a5faea2e3886dfb2a65ce092a132e7e896915
	Issue introduced in 5.3 with commit b917507e5ad983085d29069369778b16aa03a0a8 and fixed in 7.2 with commit a31e0ad444698d8aa7534a0f89fda543730f97a5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74613
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/vmw_vsock/virtio_transport.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a7658508f5fe8f1077a65e8cb9535d3426f37a2f
	https://git.kernel.org/stable/c/1aa21e7c8702a7c37cd7d3cace1a652cfa5e8171
	https://git.kernel.org/stable/c/4d37e3525cc346a1421c1bdeaad5848e249fc60c
	https://git.kernel.org/stable/c/9d80a04129a6c27a690cb69de3fe3f50be5aa8b9
	https://git.kernel.org/stable/c/a309b74e3fc052352ab778500449cb9c3853c363
	https://git.kernel.org/stable/c/38c7763fdc533edb34dc8f4489c260e8ba2ccae9
	https://git.kernel.org/stable/c/e82a5faea2e3886dfb2a65ce092a132e7e896915
	https://git.kernel.org/stable/c/a31e0ad444698d8aa7534a0f89fda543730f97a5