CVE-2026-53181 Overview
CVE-2026-53181 is a Linux kernel vulnerability in the vsock/vmci transport that causes a permanent leak of the sk_ack_backlog counter on failed VMCI handshakes. When vmci_transport_recv_connecting_server() returns an error, vmci_transport_recv_listen() calls vsock_remove_pending() without a matching sk_acceptq_removed(). The counter climbs toward sk_max_ack_backlog after each failure. Once the limit is reached, the listener socket silently refuses all new connections with -ECONNREFUSED. Recovery requires restarting the affected process, producing a denial-of-service condition on virtualization hosts and guests relying on VMCI sockets.
Critical Impact
Repeated malformed VMCI handshake packets can permanently disable a vsock listener, requiring a process restart to restore service.
Affected Products
- Linux kernel vsock/vmci transport (multiple stable branches referenced by the upstream commits)
- VMware VMCI-based virtualization environments using vsock listeners
- Hosts and guests exposing vsock listening sockets through the VMCI transport
Discovery Timeline
- 2026-06-25 - CVE-2026-53181 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53181
Vulnerability Analysis
The defect resides in the Linux kernel virtual socket (vsock) implementation over the Virtual Machine Communication Interface (VMCI). During the server-side connection state machine, vmci_transport_recv_listen() increments the accept queue counter through sk_acceptq_added() when a new pending child socket is created. On the successful path, sk_acceptq_removed() is invoked once the connection is fully accepted. On the failure path, however, the kernel only calls vsock_remove_pending() to detach the child socket, leaving sk_ack_backlog permanently inflated.
Each failed handshake — caused by malformed packets, queue pair allocation failure, or event subscription failure — increases the counter by one. When the value reaches sk_max_ack_backlog, the listener begins rejecting every subsequent connection with -ECONNREFUSED. The condition is silent: no log entry indicates that the socket has stopped accepting traffic.
Root Cause
The root cause is an unbalanced reference to the accept queue accounting on the error path of vmci_transport_recv_listen(). The two existing sk_acceptq_removed() calls in af_vsock.c do not cover this code path. The call near line 764 is gated by vsock_is_pending(), which returns false after vsock_remove_pending() has executed. The call near line 1889 only runs on a successful accept(). The fix balances sk_acceptq_added() with sk_acceptq_removed() on the error branch.
Attack Vector
An attacker with the ability to initiate VMCI vsock connections to a listening service can repeatedly send malformed handshake packets or otherwise trigger handshake failures. Each failure consumes one backlog slot permanently. After sk_max_ack_backlog failures, the listener is effectively offline until the owning process is restarted. The vulnerability requires local or guest-to-host reachability to the vsock listener; remote network exploitation is not applicable. See the upstream Kernel Commit ba9ad60 for the corrective patch.
Detection Methods for CVE-2026-53181
Indicators of Compromise
- Vsock listener processes returning -ECONNREFUSED to all new clients despite the service running
- sk_ack_backlog values approaching sk_max_ack_backlog for vsock listening sockets in kernel diagnostics
- Recurring VMCI handshake failures logged near the time legitimate connections begin failing
Detection Strategies
- Monitor vsock listener health by periodically attempting a known-good connection and alerting on persistent ECONNREFUSED while the process is alive
- Inspect socket statistics through ss -x or kernel debug interfaces to detect abnormal backlog growth on vsock listeners
- Correlate guest-to-host VMCI traffic anomalies, such as bursts of malformed packets, with subsequent listener unavailability
Monitoring Recommendations
- Track the running kernel version on virtualization hosts and guests against the fixed stable releases referenced in the upstream commits
- Alert when long-lived vsock services on VMware-based hosts show a sudden drop in successful accept() rates
- Capture process restarts of vsock-based services as a signal of recovery from possible backlog exhaustion
How to Mitigate CVE-2026-53181
Immediate Actions Required
- Update the Linux kernel to a stable release containing the fix for the vsock/vmci backlog leak
- Restart any vsock listening processes that currently exhibit ECONNREFUSED behavior to clear an exhausted backlog
- Restrict which guests or workloads can reach VMCI vsock listeners to trusted sources only
Patch Information
The fix is distributed across multiple stable Linux kernel branches. Relevant upstream commits include Kernel Commit 22c587a, Kernel Commit 9698582, Kernel Commit ba9ad60, Kernel Commit bcb2756, Kernel Commit c05fa14, Kernel Commit cf7090e, Kernel Commit dfd8531, and Kernel Commit ea0b03d. The patch adds the missing sk_acceptq_removed() call on the error path in vmci_transport_recv_listen().
Workarounds
- Disable or unload the vmw_vsock_vmci_transport module on hosts that do not require VMCI vsock connectivity
- Limit exposure of vsock listening services to trusted guests using hypervisor-level access controls
- Implement service watchdogs that restart vsock-based daemons when accept failures persist beyond a defined threshold
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
