CVE-2026-99123: Linux Vulnerability (CVSS 7.1)

Description

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening and connecting sockets, but sockets remain in the bound table after connect(), so it can also return a non-listening socket. The fallback does not validate the source address. In TCP_SYN_SENT, a RESPONSE from an unrelated source can transition the victim socket to TCP_ESTABLISHED while its stored remote address remains unchanged. Subsequent RW packets from that source are delivered through the same destination-only fallback. This was reproduced with capability-empty processes under different UIDs. The attacker discovered the target tuple through unprivileged AF_VSOCK sock_diag and caused the victim socket to read 16 attacker-chosen bytes; the intended peer-side socket read 0 of those 16 bytes. Add vsock_check_source() to validate the transport, source port and source CID against the peer stored in a non-listening socket. The local transport is the CID exception because its packets are generated internally with VMADDR_CID_LOCAL as their source, including connections using CID aliases. Use the helper after lock_sock() in the virtio receive path.

Metrics

CVSS 3.1

7.1/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS Probability

0.17%

5.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 06a8fc78367d070720af960dcecec917d3ae5f3b, < bda841af86cdfe7fcf4a2f4db22e27f1b852b1ff; >= 06a8fc78367d070720af960dcecec917d3ae5f3b, < c0a3a786a5e8b5007d6a3c34721ab052399ab2ad; >= 06a8fc78367d070720af960dcecec917d3ae5f3b, < f77fb90edca5385d0eecbfd6d2c8ef60afff24a9; >= 06a8fc78367d070720af960dcecec917d3ae5f3b, < ec231dd3b14e541ba1c4f842a7d152fb61037333; >= 06a8fc78367d070720af960dcecec917d3ae5f3b, < 6cd829de69efd9ed3a53aa2421004a0396eb2bd7; >= 06a8fc78367d070720af960dcecec917d3ae5f3b, < e9bf92de436ba55f33eaa55d7008e68551123cfd; >= 06a8fc78367d070720af960dcecec917d3ae5f3b, < dee44f41f206becb41c492899c1996cfd7f82a1b
Linux	Linux	4.8

References

Timeline

Published: Oct 28, 2026
Last Modified: Oct 31, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-99123?

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: validate packet source for connected sockets virtio_transport_recv_pkt() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback is needed for listening and connecting sockets, but sockets remain in the bound table after connect(), so it can also return a non-listening socket. The fallback does not validate the source address. In TCP_SYN_SENT, a RESPONSE from an unrelated source can transition the victim socket to TCP_ESTABLISHED while its stored remote address remains unchanged. Subsequent RW packets from that source are delivered through the same destination-only fallback. This was reproduced with capability-empty processes under different UIDs. The attacker discovered the target tuple through unprivileged AF_VSOCK sock_diag and caused the victim socket to read 16 attacker-chosen bytes; the intended peer-side socket read 0 of those 16 bytes. Add vsock_check_source() to validate the transport, source port and source CID against the peer stored in a non-listening socket. The local transport is the CID exception because its packets are generated internally with VMADDR_CID_LOCAL as their source, including connections using CID aliases. Use the helper after lock_sock() in the virtio receive path.

How severe is CVE-2026-99123?

CVE-2026-99123 has a CVSS score of 7.1/10 (HIGH severity). The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.

How do I fix CVE-2026-99123?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →