CVE-2026-53181

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vsock/vmci: fix sk_ack_backlog leak on failed handshake<br /> <br /> When vmci_transport_recv_connecting_server() returns an error,<br /> vmci_transport_recv_listen() calls vsock_remove_pending() but never<br /> calls sk_acceptq_removed(). This leaves sk_ack_backlog incremented<br /> permanently.<br /> <br /> Repeated handshake failures (malformed packets, queue pair alloc<br /> failure, event subscribe failure) cause sk_ack_backlog to climb<br /> toward sk_max_ack_backlog. Once it reaches the limit the listener<br /> permanently refuses all new connections with -ECONNREFUSED, a<br /> silent denial of service requiring a process restart to recover.<br /> <br /> The two existing sk_acceptq_removed() calls in af_vsock.c do not<br /> cover this path: line 764 checks vsock_is_pending() which returns<br /> false after vsock_remove_pending(), and line 1889 is only reached<br /> on successful accept().<br /> <br /> Fix by balancing sk_acceptq_added() with sk_acceptq_removed() on<br /> the error path.