CVE-2026-53181

In the Linux kernel, the following vulnerability has been resolved:

vsock/vmci: fix skackbacklog leak on failed handshake

When vmcitransportrecvconnectingserver() returns an error, vmcitransportrecvlisten() calls vsockremovepending() but never calls skacceptqremoved(). This leaves skack_backlog incremented permanently.

Repeated handshake failures (malformed packets, queue pair alloc failure, event subscribe failure) cause skackbacklog to climb toward skmaxack_backlog. Once it reaches the limit the listener permanently refuses all new connections with -ECONNREFUSED, a silent denial of service requiring a process restart to recover.

The two existing skacceptqremoved() calls in afvsock.c do not cover this path: line 764 checks vsockispending() which returns false after vsockremove_pending(), and line 1889 is only reached on successful accept().

Fix by balancing skacceptqadded() with skacceptqremoved() on the error path.