CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vsock/vmci: fix UAF when peer resets connection during handshake

vmci_transport_recv_connecting_server() returned err = 0 for a peer
RST in its default switch arm:

	err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;

That made vmci_transport_recv_listen() skip vsock_remove_pending(),
leaving the pending socket on the listener's pending_links with
sk_state = TCP_CLOSE while destroy: still dropped the explicit
reference taken before schedule_delayed_work().

One second later vsock_pending_work() observed is_pending=true and
performed full cleanup: vsock_remove_pending() then the two trailing
sock_put(sk) calls -- the first reached refcount 0 and __sk_freed
the socket, and the second wrote into the freed object:

  BUG: KASAN: slab-use-after-free in refcount_warn_saturate
  Write of size 4 at addr ffff88800b1cac80 by task kworker
  Workqueue: events vsock_pending_work

Treat peer RST like any other unexpected packet type (err = -EINVAL).
All destroy: arms now return err < 0, so vmci_transport_recv_listen()
removes pending from pending_links synchronously and
vsock_pending_work() takes the is_pending=false / !rejected branch,
dropping only its own work reference.  This also closes the
multi-packet race Sashiko reported on v2: pending is removed from
the list before any subsequent packet can find it.

The pre-existing sk_acceptq_removed() gap on the err < 0 path of
vmci_transport_recv_listen() that Sashiko also noted is not
introduced or changed by this patch.

Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.

The Linux kernel CVE team has assigned CVE-2026-64115 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 5.10.258 with commit 1e19f08552b90070ed18bafb1763c78297823af6
	Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 5.15.209 with commit 1dd531e28f61edd286edc486ab068f135b5ae1eb
	Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 6.1.175 with commit ecda37f8faab3220da199335e42564cb7a9ad145
	Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 6.6.142 with commit cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb
	Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 6.12.92 with commit 47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9
	Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 6.18.34 with commit 440447699c681e26ed58e9c309cad718270a18b4
	Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 7.0.11 with commit 9fe74e42914c851d68069713b7b917a9c33faf26
	Issue introduced in 3.9 with commit d021c344051af91f42c5ba9fdedc176740cbd238 and fixed in 7.1 with commit 99e22ddf4edb63dc8382bc028af928056d3450cf

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64115
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/vmw_vsock/vmci_transport.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6
	https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb
	https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145
	https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb
	https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9
	https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4
	https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26
	https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf