CVE-2026-99213: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99213 is a race condition vulnerability in the Linux kernel's vsock (virtual socket) subsystem that can lead to kernel memory corruption and crashes. The flaw exists in the handling of the TCP_ESTABLISHED to TCP_CLOSING state transition when a socket receives an OP_RST while still present in connected_table, potentially causing a double list insertion. It affects Linux kernel versions from 3.9 onward, with fixes available in stable commits targeting affected git trees. The CVSS category is estimated as Medium by Feedly (GitHub Advisory, Feedly).

The root cause is a race condition (CWE not formally assigned) in the vsock loopback transport's connection state machine. When a socket in TCP_ESTABLISHED state receives an OP_RST that races with the connect loop, the socket can be reset while still present in connected_table. This allows vsock_insert_connected() to be called again on the same socket, triggering a list_add double add kernel BUG at lib/list_debug.c:35. The fix ensures that TCP_ESTABLISHED and TCP_CLOSING states are treated as "once-established" — immediately breaking out of the connect loop and returning 0 — so that post-connection events (such as OP_RST) do not corrupt the return value or the kernel's internal data structures. This fix is supplementary to commit 002541ef650b ("vsock: Ignore signal/timeout on connect() if already established") (GitHub Advisory).

A local attacker with the ability to establish vsock connections can trigger the race condition in the vsock loopback transport, causing a kernel BUG (Oops: invalid opcode) and system crash, which constitutes a denial of service. Beyond crashing the system, the double list insertion results in kernel memory corruption, which could potentially be leveraged for privilege escalation or further kernel exploitation, though no such exploitation has been demonstrated publicly. The impact is limited to the local system; remote exploitation is not applicable given the local attack vector (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (October 28, 2026). The vulnerability requires local access to a system with vsock connections enabled, limiting the attack surface. No EPSS score or CISA KEV catalog entry has been reported for this CVE (Feedly, GitHub Advisory).

• Logs: Kernel logs (dmesg or /var/log/kern.log) containing list_add double add messages, kernel BUG at lib/list_debug.c:35!, or Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI.
• Logs: Stack traces referencing vsock_insert_connected.cold, virtio_transport_recv_pkt, vsock_loopback_work, or process_one_work in kernel crash logs.
• Process: Unexpected crashes or restarts of workqueue threads associated with vsock-loopback.
• System: Sudden system reboots or kernel panics on hosts using vsock (e.g., VM hypervisor hosts using virtio-vsock) (GitHub Advisory).

Apply the kernel patches available at the following stable commits: c2c5359ef2c33684fa3f3652fd761a483db8d1e7, 44d1ca05d6094a5d75c671a0545249186d790b8d, and 4f6ac74fa594a918d41255c941256e1d51592d3b. Unaffected versions include Linux kernel 6.18.59 and later in the 6.18.x series, 7.2.13 and later in the 7.2.x series, and 7.3 and above. As a workaround, restrict local access to vsock connections where operationally feasible until a patched kernel version is deployed (GitHub Advisory, Feedly).