CVE-2026-98947

In the Linux kernel, the following vulnerability has been resolved:

vsock: Fix memory leak in vmci transport recv dgram cb()

During the closure of a datagram socket, the vmci transport recv dgram cb() function may be called, which will add the packets to the socket's backlog; then, after the receive queue is cleared, the release sock() function will move the packet back from the socket's backlog to the receive queue, which will lead to a memory leak.

sock close sock release vsock release // take ownership by user-space lock sock nested sock set flag(sk, SOCK DEAD) vmci transport release vmci dispatch dgs vmci datagram invoke guest handler vmci transport recv dgram cb sk receive skb if (!sock owned by user(sk)) [...] (!) else if sk add backlog() [...] (!) skb queue purge(&sk->sk receive queue)

release sock release sock // move all packets from the backlog // to the receive queue (!) sk backlog rcv vsock queue rcv skb [...] sock queue rcv skb if (!sock flag(sk, SOCK DEAD)) // Since the socket is "dead", the function will not // be called sk->sk data ready(sk) sock release ownership(sk); sock put

Add a receive queue cleanup in the socket destructor to fix this.

syzkaller report:

unreferenced object 0xffff8880117bfb80 (size 240): comm "irq/56-vmw vmci", pid 205, jiffies 4295064448 (age 73.992s) hex dump (first 32 bytes): 78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.&.....x.&..... 00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........&..... backtrace: [] alloc skb+0x287/0x330 net/core/skbuff.c:505 [] vmci transport recv dgram cb+0xbd/0x210 [vmw vsock vmci transport] [] vmci datagram invoke guest handler+0x366/0x450 [vmw vmci] [] vmci dispatch dgs+0x235/0x490 [vmw vmci] [] vmci interrupt+0x55/0x290 [vmw vmci] [] irq thread fn+0x8b/0x1a0 kernel/irq/manage.c:1205 [] irq thread+0x28e/0x530 kernel/irq/manage.c:1314 [] kthread+0x2e6/0x3a0 kernel/kthread.c:376 [] ret from fork+0x22/0x30 arch/x86/entry/entry 64.S:295

Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller.