Race condition in Linux kernel - CVE-2026-74614

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in virtio vsock worker handling in net/vmw_vsock/virtio_transport.c when processing virtqueue work across freeze and restore operations. A local user can trigger worker activity during suspend and restore state transitions to cause a denial of service.

The issue affects the RX, TX, and event workers when a delayed worker observes a replacement queue state while retaining a pointer to a deleted queue.

Affected software

How to mitigate CVE-2026-74614

External References

• https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f
• https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570
• https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a
• https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c
• https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a
• https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513
• https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace

Related Security Bulletins

• Race condition in Linux kernel vmw_vsock
• Debian update for linux