CVE-2026-74614: vsock/virtio: read virtqueues under worker locks

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vsock/virtio: read virtqueues under worker locks

Commit bd50c5dc182b ("vsock/virtio: add support for device
suspend/resume") made the *_run flags transition from false to true when
restore installs replacement virtqueues.  The RX, TX and event workers
read their virtqueue before locking and checking the corresponding flag,
so a worker delayed across freeze and restore can observe the replacement
queue's running state while retaining a pointer to the deleted queue.

Read each virtqueue under its mutex after checking the run flag, keeping
the pointer and state in the same queue generation.

The Linux kernel CVE team has assigned CVE-2026-74614 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15.138 with commit 762c251c7f5c4ee5bef71460c6e822ed293fd69f and fixed in 5.15.216 with commit 941329ce14c5f481223a10d1d4c8b57ea7f3048a
	Issue introduced in 5.19 with commit bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c and fixed in 6.1.183 with commit 29dd10583bf9d2744cd84b862e4257c0a5699570
	Issue introduced in 5.19 with commit bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c and fixed in 6.6.152 with commit a1fb0c5b8a7c2753758aeced40971f99449dde0c
	Issue introduced in 5.19 with commit bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c and fixed in 6.12.104 with commit eae099c764c7ebdb842eb1f638913e310bdd6513
	Issue introduced in 5.19 with commit bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c and fixed in 6.18.45 with commit bd43a7ec668be428265b3209eb43647aedcf720a
	Issue introduced in 5.19 with commit bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c and fixed in 7.1.9 with commit 1cecb4202afdbeddcf29d59baf596ac6ab753f7f
	Issue introduced in 5.19 with commit bd50c5dc182b0a52599f87b429f9a5a9cbfc9b1c and fixed in 7.2 with commit ebac8f6b1ef0e9278afe204b8692a7479988dace

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74614
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/vmw_vsock/virtio_transport.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/941329ce14c5f481223a10d1d4c8b57ea7f3048a
	https://git.kernel.org/stable/c/29dd10583bf9d2744cd84b862e4257c0a5699570
	https://git.kernel.org/stable/c/a1fb0c5b8a7c2753758aeced40971f99449dde0c
	https://git.kernel.org/stable/c/eae099c764c7ebdb842eb1f638913e310bdd6513
	https://git.kernel.org/stable/c/bd43a7ec668be428265b3209eb43647aedcf720a
	https://git.kernel.org/stable/c/1cecb4202afdbeddcf29d59baf596ac6ab753f7f
	https://git.kernel.org/stable/c/ebac8f6b1ef0e9278afe204b8692a7479988dace