SB20261029202 - Origin validation error in Linux kernel vmw_vsock

Description

This security bulletin contains information about 1 vulnerability.

1) Origin validation error (CVE-ID: CVE-2026-99123)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to inject attacker-chosen data into another process's AF_VSOCK connection.

The vulnerability exists due to improper validation of packet source addresses in virtio_transport_recv_pkt() when matching incoming packets through the destination-only bound-socket lookup. A local user can send a RESPONSE packet from an unrelated source to a socket in TCP_SYN_SENT to transition it to TCP_ESTABLISHED, then send RW packets through the same fallback to inject data despite the socket retaining its intended peer address.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/6cd829de69efd9ed3a53aa2421004a0396eb2bd7
• https://git.kernel.org/stable/c/dee44f41f206becb41c492899c1996cfd7f82a1b
• https://git.kernel.org/stable/c/e9bf92de436ba55f33eaa55d7008e68551123cfd