{"id":"CVE-2026-46214","state":"PUBLISHED","title":"vsock/virtio: fix accept queue count leak on transport mismatch","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix accept queue count leak on transport mismatch\n\nvirtio_transport_recv_listen() calls sk_acceptq_added() before\nvsock_assign_transport(). If vsock_assign_transport() fails or\nselects a different transport, the error path returns without\ncalling sk_acceptq_removed(), permanently incrementing\nsk_ack_backlog.\n\nAfter approximately backlog+1 such failures, sk_acceptq_is_full()\nreturns true, causing the listener to reject all new connections.\n\nFix by moving sk_acceptq_added() to after the transport validation,\nmatching the pattern used by vmci_transport and hyperv_transport.","publishedAt":"2026-05-28T09:40:31.245Z","updatedAt":"2026-10-15T01:21:19.627Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"2ea5d2c79edcc99c7dbe0bb7518f5e1ee2a2391f","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"fd51e810affa38d735d04261e673b2a5fe9c8665","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"f66c7904fb6f0e420a654bc90909e64a25d00896","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"65c484726e74013a2ec7ba67a34d87760ae8f390","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"29371f3cc83e2a92265b4768014a30b80234112f","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"e9edf9893cf26d060705c910a9b62d8cc96ed56a","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"6d3275fc4ed968938e1d556c344798046776668d","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"52bcb57a4e8a0865a76c587c2451906342ae1b2d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/vmw_vsock/virtio_transport_common.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.5","versionType":"semver"},{"version":"5.10.258","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.90","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.32","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.9","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/vmw_vsock/virtio_transport_common.c"]}],"references":["https://git.kernel.org/stable/c/2ea5d2c79edcc99c7dbe0bb7518f5e1ee2a2391f","https://git.kernel.org/stable/c/fd51e810affa38d735d04261e673b2a5fe9c8665","https://git.kernel.org/stable/c/f66c7904fb6f0e420a654bc90909e64a25d00896","https://git.kernel.org/stable/c/65c484726e74013a2ec7ba67a34d87760ae8f390","https://git.kernel.org/stable/c/29371f3cc83e2a92265b4768014a30b80234112f","https://git.kernel.org/stable/c/e9edf9893cf26d060705c910a9b62d8cc96ed56a","https://git.kernel.org/stable/c/6d3275fc4ed968938e1d556c344798046776668d","https://git.kernel.org/stable/c/52bcb57a4e8a0865a76c587c2451906342ae1b2d","https://cert-portal.siemens.com/productcert/html/ssa-784472.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:07.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/46xxx/CVE-2026-46214.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-46214","state":"PUBLISHED","datePublished":"2026-05-28T09:40:31.245Z","dateUpdated":"2026-10-15T01:21:19.627Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-13T15:03:33.105Z"},"containers":{"cna":{"title":"vsock/virtio: fix accept queue count leak on transport mismatch","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix accept queue count leak on transport mismatch\n\nvirtio_transport_recv_listen() calls sk_acceptq_added() before\nvsock_assign_transport(). If vsock_assign_transport() fails or\nselects a different transport, the error path returns without\ncalling sk_acceptq_removed(), permanently incrementing\nsk_ack_backlog.\n\nAfter approximately backlog+1 such failures, sk_acceptq_is_full()\nreturns true, causing the listener to reject all new connections.\n\nFix by moving sk_acceptq_added() to after the transport validation,\nmatching the pattern used by vmci_transport and hyperv_transport."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"2ea5d2c79edcc99c7dbe0bb7518f5e1ee2a2391f","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"fd51e810affa38d735d04261e673b2a5fe9c8665","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"f66c7904fb6f0e420a654bc90909e64a25d00896","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"65c484726e74013a2ec7ba67a34d87760ae8f390","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"29371f3cc83e2a92265b4768014a30b80234112f","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"e9edf9893cf26d060705c910a9b62d8cc96ed56a","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"6d3275fc4ed968938e1d556c344798046776668d","versionType":"git"},{"version":"c0cfa2d8a788fcf45df5bf4070ab2474c88d543a","status":"affected","lessThan":"52bcb57a4e8a0865a76c587c2451906342ae1b2d","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/vmw_vsock/virtio_transport_common.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.5","versionType":"semver"},{"version":"5.10.258","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.140","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.90","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.32","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.9","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/vmw_vsock/virtio_transport_common.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/2ea5d2c79edcc99c7dbe0bb7518f5e1ee2a2391f"},{"url":"https://git.kernel.org/stable/c/fd51e810affa38d735d04261e673b2a5fe9c8665"},{"url":"https://git.kernel.org/stable/c/f66c7904fb6f0e420a654bc90909e64a25d00896"},{"url":"https://git.kernel.org/stable/c/65c484726e74013a2ec7ba67a34d87760ae8f390"},{"url":"https://git.kernel.org/stable/c/29371f3cc83e2a92265b4768014a30b80234112f"},{"url":"https://git.kernel.org/stable/c/e9edf9893cf26d060705c910a9b62d8cc96ed56a"},{"url":"https://git.kernel.org/stable/c/6d3275fc4ed968938e1d556c344798046776668d"},{"url":"https://git.kernel.org/stable/c/52bcb57a4e8a0865a76c587c2451906342ae1b2d"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-06-14T18:03:15.809Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.258"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"6.6.140"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"6.12.90"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"6.18.32"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"7.0.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:21:19.627Z"},"x_adpType":"supplier"}]}}}