CVE-2026-99213— vsock: treat TCP_CLOSING as once-established

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： vsock：将 TCP_CLOSING 状态视为“已建立” 修复了在收到 OP_RST（复位操作）时，处理从到状态转换的问题，该转换可能与连接循环（connect loop）发生竞态条件。一旦连接处于或状态，应立即中断并返回 0。的返回值应反映连接建立或失败之前所发生的情况，而之后发生的事件不应影响该返回值。例如，即使已经设置了，仍应返回 0，而不应因此返回。同时，修正了上方注释中不准确的内容。如果对一个仍存在于（连接表）中的套接字执行重置操作，

AI Predicted 7.8 Difficulty: Moderate Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Updated Oct 28, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

vsock: treat TCP_CLOSING as once-established

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: vsock: treat TCP_CLOSING as once-established Handle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHED/CLOSING. The return value of connect() should reflect what happened up to the point the connection was established or failed. Events that occur afterwards must not affect it. E.g. even if OP_RW has already set sk_err, connect() should still return 0, not ENOBUFS because of it. Adapt the inaccurate comment above signal_pending(). Resetting a socket that is still present in connected_table can lead to memory corruption. The reporter noted lost transports for in-flight skbs, and I have reproduced crashes caused by re-insertion into connected_table. list_add double add: new=, prev=, next=. kernel BUG at lib/list_debug.c:35! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:__list_add_valid_or_report+0x11f/0x130 Call Trace: vsock_insert_connected.cold+0xe/0x13 virtio_transport_recv_pkt+0x10e9/0x1460 vsock_loopback_work+0x305/0x480 process_one_work+0xe4c/0x1560 worker_thread+0x4f1/0xd60 kthread+0x36e/0x470 ret_from_fork+0x47b/0x6b0 ret_from_fork_asm+0x1a/0x30 This fix is supplementary to commit 002541ef650b ("vsock: Ignore signal/timeout on connect() if already established"). Details under Link.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	d021c344051af91f42c5ba9fdedc176740cbd238 ~ c2c5359ef2c33684fa3f3652fd761a483db8d1e7	-
Linux	Linux	3.9	-

II. Public POCs for CVE-2026-99213

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99213

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99213 (3)

https://www.cve.org/CVERecord?id=CVE-2026-99213

Same Patch Batch · Linux · 2026-10-28 · 117 CVEs total

CVE-2026-99143		tracing: Keep the predicate limit separate from program capacity
CVE-2026-99129		selinux: fix BPF token permission checks
CVE-2026-99130		io_uring/cancel: don't spin on local work the task can't run
CVE-2026-99131		xfs: fix capability check in xfs
CVE-2026-99133		net/iucv: fix the recvmsg window update
CVE-2026-99132		xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
CVE-2026-99134		mac802154: fix data race and NULL deref on local->assoc_dev
CVE-2026-99135		dm-integrity: fix infinite loop on discard with large tag size
CVE-2026-99137		cifs: don't update i_size in cifs_do_truncate without a cached handle
CVE-2026-99136		dm-crypt: fix a tiny race condition in crypt_dec_pending
CVE-2026-99138		tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
CVE-2026-99140		tracing: Fix hist trigger timestamps for buffered events
CVE-2026-99139		tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
CVE-2026-99141		tracing: Fix crash in print_graph_function_event()
CVE-2026-99142		tracing: Check operator stack capacity before pushing
CVE-2026-99154		scsi: libiscsi: Reject a negative task index from parse_pdu_itt
CVE-2026-99151		drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions
CVE-2026-99153		scsi: libiscsi: Validate the ITT reflected in a Reject PDU
CVE-2026-99152		scsi: libiscsi: Validate the task named by a management response
CVE-2026-99150		drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

Showing top 20 of 117 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux