Security Research

CVE-2025-21756 Linux Kernel vsock UAF: Shortest Path from Socket Subsystem to Root

#Vulnerability Analysis#Code Audit#Malware
CVE-2025-21756 Linux Kernel vsock UAF: Shortest Path from Socket Subsystem to Root

Linux kernel’s vsock_diag_dump iterates AF_VSOCK sockets but the release order between the transport pointer (sk) and the vsock pointer (vsk) is misaligned — the attacker closes one side to leave the other dangling, and the next iteration lands on freed memory, escaping to the kernel control flow.

Unlock to view this content.