In the Linux kernel, the following vulnerability has been resolved:
vsock: Do not allow binding to VMADDRPORTANY
It is possible for a vsock to autobind to VMADDRPORTANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDRPORTANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction).
Modify the check in _vsockbindconnectible() to also prevent binding to VMADDRPORT_ANY.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d73960f0cf03ef1dc9e96ec7a20e538accc26d87",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"id": "CVE-2025-38618-02ebe3a7",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44bd006d5c93f6a8f28b106cbae2428c5d0275b7",
"target": {
"file": "net/vmw_vsock/af_vsock.c",
"function": "__vsock_bind_connectible"
},
"id": "CVE-2025-38618-039543e2",
"signature_type": "Function",
"digest": {
"function_hash": "169002310476267520799577327237012848551",
"length": 852.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f01093646b49f6330bb2d36761983fd829472b1",
"target": {
"file": "net/vmw_vsock/af_vsock.c",
"function": "__vsock_bind_connectible"
},
"id": "CVE-2025-38618-22e0c272",
"signature_type": "Function",
"digest": {
"function_hash": "169002310476267520799577327237012848551",
"length": 852.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f01093646b49f6330bb2d36761983fd829472b1",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"id": "CVE-2025-38618-4d4b7752",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32950b1907919be86a7a2697d6f93d57068b3865",
"target": {
"file": "net/vmw_vsock/af_vsock.c",
"function": "__vsock_bind_connectible"
},
"id": "CVE-2025-38618-5073771b",
"signature_type": "Function",
"digest": {
"function_hash": "169002310476267520799577327237012848551",
"length": 852.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32950b1907919be86a7a2697d6f93d57068b3865",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"id": "CVE-2025-38618-53a64638",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f138be5d7f301fddad4e65ec66dfc3ceebf79be3",
"target": {
"file": "net/vmw_vsock/af_vsock.c",
"function": "__vsock_bind_connectible"
},
"id": "CVE-2025-38618-5acd81de",
"signature_type": "Function",
"digest": {
"function_hash": "317819182487369943827217752273956802274",
"length": 887.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c04a2c1ca25b9b23104124d3b2d349d934e302de",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"id": "CVE-2025-38618-5dd13aa2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf86704798c1b9c46fa59dfc2d662f57d1394d79",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"id": "CVE-2025-38618-7a55761a",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d73960f0cf03ef1dc9e96ec7a20e538accc26d87",
"target": {
"file": "net/vmw_vsock/af_vsock.c",
"function": "__vsock_bind_connectible"
},
"id": "CVE-2025-38618-7d00ba63",
"signature_type": "Function",
"digest": {
"function_hash": "169002310476267520799577327237012848551",
"length": 852.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aba0c94f61ec05315fa7815d21aefa4c87f6a9f4",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"id": "CVE-2025-38618-7d5c1541",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f138be5d7f301fddad4e65ec66dfc3ceebf79be3",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"id": "CVE-2025-38618-9300e010",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c04a2c1ca25b9b23104124d3b2d349d934e302de",
"target": {
"file": "net/vmw_vsock/af_vsock.c",
"function": "__vsock_bind_stream"
},
"id": "CVE-2025-38618-cab57435",
"signature_type": "Function",
"digest": {
"function_hash": "317819182487369943827217752273956802274",
"length": 887.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf86704798c1b9c46fa59dfc2d662f57d1394d79",
"target": {
"file": "net/vmw_vsock/af_vsock.c",
"function": "__vsock_bind_connectible"
},
"id": "CVE-2025-38618-e24515be",
"signature_type": "Function",
"digest": {
"function_hash": "317819182487369943827217752273956802274",
"length": 887.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44bd006d5c93f6a8f28b106cbae2428c5d0275b7",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"id": "CVE-2025-38618-ee82e7a7",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aba0c94f61ec05315fa7815d21aefa4c87f6a9f4",
"target": {
"file": "net/vmw_vsock/af_vsock.c",
"function": "__vsock_bind_connectible"
},
"id": "CVE-2025-38618-f844f163",
"signature_type": "Function",
"digest": {
"function_hash": "169002310476267520799577327237012848551",
"length": 852.0
},
"deprecated": false,
"signature_version": "v1"
}
]