CVE-2026-74614: Linux Kernel Race Condition Vulnerability

CVE-2026-74614 Overview

CVE-2026-74614 is a race condition in the Linux kernel's vsock/virtio subsystem. The flaw affects the device suspend/resume path introduced by commit bd50c5dc182b. The RX, TX, and event workers read their virtqueue pointer before acquiring the corresponding lock and checking the *_run flag. A worker delayed across a freeze and restore cycle can observe the replacement queue's running state while still holding a pointer to the deleted queue. This creates a use-after-free style condition where the worker operates on a stale virtqueue from a previous generation.

Critical Impact
A local attacker with the ability to trigger device suspend/resume cycles can exploit this race to achieve memory corruption in kernel context, leading to high impact on confidentiality, integrity, and availability.

Affected Products

Linux kernel versions containing commit bd50c5dc182b ("vsock/virtio: add support for device suspend/resume")
Systems using the vsock/virtio transport for guest-host communication
Virtualized environments (KVM, QEMU) relying on virtio-vsock

Discovery Timeline

2026-08-22 - CVE-2026-74614 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74614

Vulnerability Analysis

The vulnerability is a Race Condition in the virtio-vsock worker threads. The vsock/virtio driver runs three workers responsible for receive, transmit, and event handling. Each worker retrieves its virtqueue pointer from the device state and then acquires a mutex before checking the rx_run, tx_run, or event_run flag that indicates whether the queue is live.

When the device undergoes a suspend/resume cycle, the restore path installs replacement virtqueues and transitions the run flags from false to true. A worker scheduled before suspend but executed after resume observes the new flag state but continues to reference the previously freed virtqueue pointer captured before the lock was taken. The worker then operates on freed memory belonging to the old queue generation.

Root Cause

The root cause is a time-of-check to time-of-use (TOCTOU) violation between the virtqueue pointer read and the run-flag check. The pointer and its validity state are read at different points relative to the lock acquisition, allowing them to belong to different queue generations. The fix reads each virtqueue under its mutex after the run flag check, ensuring the pointer and state remain consistent within a single queue generation.

Attack Vector

Exploitation requires local access on a system where virtio-vsock is active and the attacker can influence or trigger suspend/resume events. An attacker who wins the race can cause the kernel to dereference or write to freed virtqueue memory, resulting in kernel memory corruption. The vulnerability mechanism is described in the upstream fix commits; see the Kernel Git Commit a1fb0c5 and related patches for full technical details.

// No verified public exploit code is available.
// See kernel commits for the corrective patch details.

Detection Methods for CVE-2026-74614

Indicators of Compromise

Kernel oops or panic messages referencing virtio_transport, virtio_vsock_rx_work, virtio_vsock_tx_work, or virtio_vsock_event_work after suspend/resume events
KASAN reports flagging use-after-free in drivers/vhost/vsock.c or net/vmw_vsock/virtio_transport.c
Unexpected system instability correlating with virtual machine suspend, hibernate, or migration operations

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to catch stale virtqueue dereferences during suspend/resume fuzzing
Monitor kernel ring buffer output via journalctl -k for oops signatures involving vsock worker functions
Correlate host-side power management events with guest kernel crash telemetry across the fleet

Monitoring Recommendations

Ingest kernel logs and crash dumps into a centralized data lake for cross-host correlation of suspend/resume-related faults
Track kernel package versions across virtualized workloads to identify unpatched hosts running vulnerable builds
Alert on repeated worker-thread crashes in virtio_transport modules following power state transitions

How to Mitigate CVE-2026-74614

Immediate Actions Required

Apply the upstream stable kernel updates containing the fix commits referenced by the CVE
Inventory hosts and guests using virtio-vsock and prioritize patching systems that perform frequent suspend/resume or live migration
Restrict local access on multi-tenant hypervisors until patched kernels are deployed

Patch Information

The fix is available across multiple stable branches. Relevant upstream commits include Kernel Git Commit 1cecb42, Kernel Git Commit 29dd105, Kernel Git Commit 941329c, Kernel Git Commit a1fb0c5, Kernel Git Commit bd43a7e, Kernel Git Commit eae099c, and Kernel Git Commit ebac8f6. Rebuild and redeploy custom kernels that include the vsock/virtio transport.

Workarounds

Unload the vmw_vsock_virtio_transport module on systems that do not require guest-host socket communication
Disable device suspend, hibernate, and live migration on hosts running unpatched kernels where virtio-vsock is required
Blocklist the vsock kernel module via modprobe configuration if the transport is unused

bash

# Verify running kernel and check module status
uname -r
lsmod | grep vsock

# Temporarily unload virtio-vsock if unused
sudo modprobe -r vmw_vsock_virtio_transport

# Persistently blocklist the module
echo "blacklist vmw_vsock_virtio_transport" | sudo tee /etc/modprobe.d/blacklist-vsock.conf