CVE-2026-53181

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53181
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53181.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53181
Downstream
Related
Published
2026-06-25T08:38:55Z
Modified
2026-08-27T18:26:01Z
Summary
vsock/vmci: fix sk_ack_backlog leak on failed handshake
Details

In the Linux kernel, the following vulnerability has been resolved:

vsock/vmci: fix sk_ack_backlog leak on failed handshake

When vmci_transport_recv_connecting_server() returns an error, vmci_transport_recv_listen() calls vsock_remove_pending() but never calls sk_acceptq_removed(). This leaves sk_ack_backlog incremented permanently.

Repeated handshake failures (malformed packets, queue pair alloc failure, event subscribe failure) cause sk_ack_backlog to climb toward sk_max_ack_backlog. Once it reaches the limit the listener permanently refuses all new connections with -ECONNREFUSED, a silent denial of service requiring a process restart to recover.

The two existing sk_acceptq_removed() calls in af_vsock.c do not cover this path: line 764 checks vsock_is_pending() which returns false after vsock_remove_pending(), and line 1889 is only reached on successful accept().

Fix by balancing sk_acceptq_added() with sk_acceptq_removed() on the error path.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53181.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d021c344051af91f42c5ba9fdedc176740cbd238
Fixed
22c587aa3ab1ab5264daff3ec32136fd30436c13
Fixed
cf7090e255d74c4b61c51f8ede9fcacdd8393b5b
Fixed
ea0b03d52881c12a8c634ea0d6cbfa61cefdb488
Fixed
dfd853197615d322d3a88dbcab91fc0fd2096219
Fixed
bcb275626055df7f8f947f1a349754b4004d9a15
Fixed
ba9ad6015937a5e46ba1a31370e3efdec8abbdcc
Fixed
9698582a4dd9c4a05889d7db96d4c0edc9e69cac
Fixed
c05fa14db43ebef3bd862ca9d073981c0358b3f0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53181.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.9.0
Fixed
5.10.259
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.210
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.176
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.143
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.94
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.36
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.13

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53181.json"