CVE record · CVE-2026-90138

vsock: don't check the listener's sk_err in vsock_accept()

No CVSS scoreEPSS 0.0023 · 13th percentile

Published by the CVE Program (CNA: Linux) at 17 Sept 2026, 16:06 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected d021c344051af91f42c5ba9fdedc176740cbd238 to before c99d12052f663d9914bc944302fee5a1d50d8ca5 git affected d021c344051af91f42c5ba9fdedc176740cbd238 to before 64348c55dd7596ca2c033dcd102af44bdd7e8acd git affected d021c344051af91f42c5ba9fdedc176740cbd238 to before c5a75d37c21e558cc6fad1597e732ead30745eed git affected d021c344051af91f42c5ba9fdedc176740cbd238 to before 36e5fa009f98a4edbe1783ac11c0df672b224742 git affected d021c344051af91f42c5ba9fdedc176740cbd238 to before 491b368a0c6e5f28b615a50b0d384f5c25fde2a7 git affected d021c344051af91f42c5ba9fdedc176740cbd238 to before b8c899cf5e7be29840a172c183dedd8d3e7a0287 git Other versions: unaffected
Linux	Linux	affected 3.9 unaffected before 3.9 semver unaffected 6.1.191 to 6.1., inclusive semver unaffected 6.6.160 to 6.6., inclusive semver unaffected 6.12.110 to 6.12., inclusive semver unaffected 6.18.52 to 6.18., inclusive semver unaffected 7.2.6 to 7.2., inclusive semver unaffected 7.3 to , inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-90138
CNA: Linux
Tags: Linux kernel
Published: 17 Sept 2026
Updated: 30 Oct 2026

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

The Linux kernel vsock code is affected from version 3.9 until the fixed stable releases. A user who can create vsock sockets can cause accept() to reject valid incoming connections because of a stale error, which leaks the rejected child sockets. Upgrade to 6.1.191, 6.6.160, 6.12.110, or 6.18.52, or the later release in each series.

Written 12 Nov 2026.

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

CISA KEV Not listed.
EPSS 0.0023, the 13th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 17 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.