CVE-2026-74614

vsock/virtio: read virtqueues under worker locks

State: Published
Severity: 8.4 High
Published: Aug 22, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: read virtqueues under worker locks

Commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume") made the *_run flags transition from false to true when restore installs replacement virtqueues. The RX, TX and event workers read their virtqueue before locking and checking the corresponding flag, so a worker delayed across freeze and restore can observe the replacement queue's running state while retaining a pointer to the deleted queue.

Read each virtqueue under its mutex after checking the run flag, keeping the pointer and state in the same queue generation.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	762c251c7f5c4ee5bef71460c6e822ed293fd69f to before 941329ce14c5f481223a10d1d4c8b57ea7f3048aAffected bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to before 29dd10583bf9d2744cd84b862e4257c0a5699570Affected bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to before a1fb0c5b8a7c2753758aeced40971f99449dde0cAffected bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to before eae099c764c7ebdb842eb1f638913e310bdd6513Affected bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to before bd43a7ec668be428265b3209eb43647aedcf720aAffected bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to before 1cecb4202afdbeddcf29d59baf596ac6ab753f7fAffected bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to before ebac8f6b1ef0e9278afe204b8692a7479988daceAffected 5.15.138 to before 5.15.216Affected
LinuxLinux	5.19Affected before 5.19Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.152 through 6.6.Not affected 6.12.104 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

762c251c7f5c4ee5bef71460c6e822ed293fd69f to before 941329ce14c5f481223a10d1d4c8b57ea7f3048aAffected
bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to before 29dd10583bf9d2744cd84b862e4257c0a5699570Affected
bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to before a1fb0c5b8a7c2753758aeced40971f99449dde0cAffected
bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to before eae099c764c7ebdb842eb1f638913e310bdd6513Affected
bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to before bd43a7ec668be428265b3209eb43647aedcf720aAffected
bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to before 1cecb4202afdbeddcf29d59baf596ac6ab753f7fAffected
bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c to before ebac8f6b1ef0e9278afe204b8692a7479988daceAffected
5.15.138 to before 5.15.216Affected

LinuxLinux

5.19Affected
before 5.19Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.152 through 6.6.*Not affected
6.12.104 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.