# vsock: don't check the listener's sk_err in vsock_accept()

CVE record · `CVE-2026-90138`

- **Identifiers:** `CVE-2026-90138`
- **State:** Confirmed
- **Severity:** No CVSS score
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 17 Sept 2026
- **Updated:** 30 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 17 Sept 2026, 16:06 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `d021c344051af91f42c5ba9fdedc176740cbd238 to before c99d12052f663d9914bc944302fee5a1d50d8ca5` (git)
  - affected: `d021c344051af91f42c5ba9fdedc176740cbd238 to before 64348c55dd7596ca2c033dcd102af44bdd7e8acd` (git)
  - affected: `d021c344051af91f42c5ba9fdedc176740cbd238 to before c5a75d37c21e558cc6fad1597e732ead30745eed` (git)
  - affected: `d021c344051af91f42c5ba9fdedc176740cbd238 to before 36e5fa009f98a4edbe1783ac11c0df672b224742` (git)
  - affected: `d021c344051af91f42c5ba9fdedc176740cbd238 to before 491b368a0c6e5f28b615a50b0d384f5c25fde2a7` (git)
  - affected: `d021c344051af91f42c5ba9fdedc176740cbd238 to before b8c899cf5e7be29840a172c183dedd8d3e7a0287` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `3.9`
  - unaffected: `before 3.9` (semver)
  - unaffected: `6.1.191 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.160 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.110 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.52 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.6 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

> The Linux kernel vsock code is affected from version 3.9 until the fixed stable releases. A user who can create vsock sockets can cause accept() to reject valid incoming connections because of a stale error, which leaks the rejected child sockets. Upgrade to 6.1.191, 6.6.160, 6.12.110, or 6.18.52, or the later release in each series.

Written 12 Nov 2026.

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

No source has published a CVSS score for this record yet.

- **CISA KEV:** Not listed.
- **EPSS:** 0.0023, the 13th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 17 Sept 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-90138](https://www.cve.org/CVERecord?id=CVE-2026-90138)
- [NVD: CVE-2026-90138](https://nvd.nist.gov/vuln/detail/CVE-2026-90138)

### References from the CNA

- <https://git.kernel.org/stable/c/c99d12052f663d9914bc944302fee5a1d50d8ca5>
- <https://git.kernel.org/stable/c/64348c55dd7596ca2c033dcd102af44bdd7e8acd>
- <https://git.kernel.org/stable/c/c5a75d37c21e558cc6fad1597e732ead30745eed>
- <https://git.kernel.org/stable/c/36e5fa009f98a4edbe1783ac11c0df672b224742>
- <https://git.kernel.org/stable/c/491b368a0c6e5f28b615a50b0d384f5c25fde2a7>
- <https://git.kernel.org/stable/c/b8c899cf5e7be29840a172c183dedd8d3e7a0287>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-90138>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-90138/>. Everything for agents: <https://agentprime.io/llms.txt>.