GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80932 (GCVE-0-2026-80932)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:58
VLAI
Title
vsock/virtio: flush works in dependency order
Summary
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtio_vsock_remove() stops the virtqueues and then flushes each work item before freeing the enclosing virtio_vsock. The current order does not account for dependencies between those items: tx_work may queue send_pkt_work, and send_pkt_work may queue rx_work. In particular, send_pkt_work can set restart_rx and release tx_lock. The remove path can then stop the queues and flush rx_work before send_pkt_work queues it. Although the later send_pkt_work flush waits for that producer to finish, nothing waits for the newly queued rx_work, so kfree(vsock) can race with it. KASAN reported: BUG: KASAN: slab-use-after-free in virtio_transport_rx_work+0x487/0x4b0 Read of size 8 at addr ffff888114c2b008 by task kworker/1:1/47 Workqueue: virtio_vsock virtio_transport_rx_work Call Trace: virtio_transport_rx_work+0x487/0x4b0 process_one_work+0x688/0x1120 worker_thread+0x45b/0xd10 Allocated by task 1: virtio_vsock_probe+0xef/0x6b0 Freed by task 84: kfree+0x131/0x3c0 virtio_vsock_remove+0xd1/0x100 Flush the works in producer-to-consumer order. virtio_vsock_vqs_del() has already disabled the queue callbacks and cleared the run flags, so after tx_work and send_pkt_work are drained, no source remains that can queue rx_work after its flush.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872 , < e059a14c1067bcc4f7b1947cd09f2baab98e340f (git)
Affected: 0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872 , < 531e2ac2dab1ab90a16427c4f9c86663633e9487 (git)
Affected: 0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872 , < f3313d952fc380cff53db9a28451a8807aa67b43 (git)
Affected: 0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872 , < b9cb4e8ba71c9fbd935d66baa71bbb0b87192c94 (git)
Affected: 0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872 , < 2187a56f2fd1715d54daed6392809223c60544f3 (git)
Affected: 0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872 , < 165a330a68b5f299d8735f0194c314cb2e571269 (git)
Affected: 0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872 , < da5e9f08714c19ba04e6863aca69d40f042f2e04 (git)
Affected: 0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872 , < 728836ebca239810f164262b10211ef59182f811 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.8
Unaffected: 0 , < 4.8 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/virtio_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e059a14c1067bcc4f7b1947cd09f2baab98e340f",
              "status": "affected",
              "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
              "versionType": "git"
            },
            {
              "lessThan": "531e2ac2dab1ab90a16427c4f9c86663633e9487",
              "status": "affected",
              "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
              "versionType": "git"
            },
            {
              "lessThan": "f3313d952fc380cff53db9a28451a8807aa67b43",
              "status": "affected",
              "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
              "versionType": "git"
            },
            {
              "lessThan": "b9cb4e8ba71c9fbd935d66baa71bbb0b87192c94",
              "status": "affected",
              "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
              "versionType": "git"
            },
            {
              "lessThan": "2187a56f2fd1715d54daed6392809223c60544f3",
              "status": "affected",
              "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
              "versionType": "git"
            },
            {
              "lessThan": "165a330a68b5f299d8735f0194c314cb2e571269",
              "status": "affected",
              "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
              "versionType": "git"
            },
            {
              "lessThan": "da5e9f08714c19ba04e6863aca69d40f042f2e04",
              "status": "affected",
              "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
              "versionType": "git"
            },
            {
              "lessThan": "728836ebca239810f164262b10211ef59182f811",
              "status": "affected",
              "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/virtio_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: flush works in dependency order\n\nvirtio_vsock_remove() stops the virtqueues and then flushes each work\nitem before freeing the enclosing virtio_vsock.  The current order does\nnot account for dependencies between those items: tx_work may queue\nsend_pkt_work, and send_pkt_work may queue rx_work.\n\nIn particular, send_pkt_work can set restart_rx and release tx_lock.\nThe remove path can then stop the queues and flush rx_work before\nsend_pkt_work queues it.  Although the later send_pkt_work flush waits\nfor that producer to finish, nothing waits for the newly queued rx_work,\nso kfree(vsock) can race with it.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in\n  virtio_transport_rx_work+0x487/0x4b0\n  Read of size 8 at addr ffff888114c2b008 by task kworker/1:1/47\n  Workqueue: virtio_vsock virtio_transport_rx_work\n  Call Trace:\n   virtio_transport_rx_work+0x487/0x4b0\n   process_one_work+0x688/0x1120\n   worker_thread+0x45b/0xd10\n  Allocated by task 1:\n   virtio_vsock_probe+0xef/0x6b0\n  Freed by task 84:\n   kfree+0x131/0x3c0\n   virtio_vsock_remove+0xd1/0x100\n\nFlush the works in producer-to-consumer order.  virtio_vsock_vqs_del()\nhas already disabled the queue callbacks and cleared the run flags, so\nafter tx_work and send_pkt_work are drained, no source remains that can\nqueue rx_work after its flush."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the guest virtio-vsock driver during virtio_vsock_remove(), reached via virtio device unplug and AF_VSOCK virtqueue completions rather than routed packets; kernel CNA guidance scores vsock and virtio guest-driver bugs as Local.\nAC:L - A malicious hypervisor controls both sides of the race by injecting vsock packets that generate RST replies so send_pkt_work sets restart_rx and queues rx_work, while concurrently hot-unplugging the device so remove() flushes rx_work too early; the attacker can retry and pause guest vCPUs, so success is not an uncontrolled condition.\nPR:N - No guest privileges are required: a malicious hypervisor or deprivileged VMM (Firecracker, crosvm, TDX/SEV-SNP) triggers device removal and virtqueue traffic with no guest credentials; host-sent packets to unbound ports generate reply skbs in kernel workqueues without any guest socket, user, or capability.\nUI:N - virtio_vsock_remove() and the racing send_pkt_work/rx_work items run from driver teardown and virtqueue IRQ workqueues; no guest user must mount a filesystem, open a device, or take any other action.\nS:U - The use-after-free corrupts the guest kernel virtio_vsock object and remains within the guest OS security authority; a guest-to-host escape would require a host vhost-vsock bug, not this guest-side remove path.\nC:H - KASAN reports a slab use-after-free read in virtio_transport_rx_work of the kfree\u0027d virtio_vsock; a workqueue callback running on a freed slab object enables attacker-controlled reuse and arbitrary kernel memory disclosure.\nI:H - After kfree(vsock), pending rx_work still runs against the freed object (rx_lock, vqs, flags); slab reuse of that work_struct yields arbitrary writes and control-flow hijack typical of kernel workqueue UAFs, not merely a crash.\nA:H - The reported KASAN bug is a kernel slab-use-after-free in virtio_transport_rx_work during device removal, causing oops or panic and fully denying guest availability even without completing a privilege-escalation exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:58:59.006Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e059a14c1067bcc4f7b1947cd09f2baab98e340f"
        },
        {
          "url": "https://git.kernel.org/stable/c/531e2ac2dab1ab90a16427c4f9c86663633e9487"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3313d952fc380cff53db9a28451a8807aa67b43"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9cb4e8ba71c9fbd935d66baa71bbb0b87192c94"
        },
        {
          "url": "https://git.kernel.org/stable/c/2187a56f2fd1715d54daed6392809223c60544f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/165a330a68b5f299d8735f0194c314cb2e571269"
        },
        {
          "url": "https://git.kernel.org/stable/c/da5e9f08714c19ba04e6863aca69d40f042f2e04"
        },
        {
          "url": "https://git.kernel.org/stable/c/728836ebca239810f164262b10211ef59182f811"
        }
      ],
      "title": "vsock/virtio: flush works in dependency order",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80932",
    "datePublished": "2026-09-11T19:42:07.012Z",
    "dateReserved": "2026-08-26T14:34:25.802Z",
    "dateUpdated": "2026-09-14T11:58:59.006Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80932",
      "date": "2026-09-17",
      "epss": "0.0014",
      "percentile": "0.03693"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/vmw_vsock/virtio_transport.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "e059a14c1067bcc4f7b1947cd09f2baab98e340f",
                    "status": "affected",
                    "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "531e2ac2dab1ab90a16427c4f9c86663633e9487",
                    "status": "affected",
                    "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f3313d952fc380cff53db9a28451a8807aa67b43",
                    "status": "affected",
                    "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b9cb4e8ba71c9fbd935d66baa71bbb0b87192c94",
                    "status": "affected",
                    "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2187a56f2fd1715d54daed6392809223c60544f3",
                    "status": "affected",
                    "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "165a330a68b5f299d8735f0194c314cb2e571269",
                    "status": "affected",
                    "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "da5e9f08714c19ba04e6863aca69d40f042f2e04",
                    "status": "affected",
                    "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "728836ebca239810f164262b10211ef59182f811",
                    "status": "affected",
                    "version": "0ea9e1d3a9e3ef7d2a1462d3de6b95131dc7d872",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/vmw_vsock/virtio_transport.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.8"
                  },
                  {
                    "lessThan": "4.8",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: flush works in dependency order\n\nvirtio_vsock_remove() stops the virtqueues and then flushes each work\nitem before freeing the enclosing virtio_vsock.  The current order does\nnot account for dependencies between those items: tx_work may queue\nsend_pkt_work, and send_pkt_work may queue rx_work.\n\nIn particular, send_pkt_work can set restart_rx and release tx_lock.\nThe remove path can then stop the queues and flush rx_work before\nsend_pkt_work queues it.  Although the later send_pkt_work flush waits\nfor that producer to finish, nothing waits for the newly queued rx_work,\nso kfree(vsock) can race with it.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in\n  virtio_transport_rx_work+0x487/0x4b0\n  Read of size 8 at addr ffff888114c2b008 by task kworker/1:1/47\n  Workqueue: virtio_vsock virtio_transport_rx_work\n  Call Trace:\n   virtio_transport_rx_work+0x487/0x4b0\n   process_one_work+0x688/0x1120\n   worker_thread+0x45b/0xd10\n  Allocated by task 1:\n   virtio_vsock_probe+0xef/0x6b0\n  Freed by task 84:\n   kfree+0x131/0x3c0\n   virtio_vsock_remove+0xd1/0x100\n\nFlush the works in producer-to-consumer order.  virtio_vsock_vqs_del()\nhas already disabled the queue callbacks and cleared the run flags, so\nafter tx_work and send_pkt_work are drained, no source remains that can\nqueue rx_work after its flush."
          }
        ],
        "id": "CVE-2026-80932",
        "lastModified": "2026-09-14T13:18:49.483",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:18:57.023",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/165a330a68b5f299d8735f0194c314cb2e571269"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2187a56f2fd1715d54daed6392809223c60544f3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/531e2ac2dab1ab90a16427c4f9c86663633e9487"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/728836ebca239810f164262b10211ef59182f811"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b9cb4e8ba71c9fbd935d66baa71bbb0b87192c94"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/da5e9f08714c19ba04e6863aca69d40f042f2e04"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e059a14c1067bcc4f7b1947cd09f2baab98e340f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f3313d952fc380cff53db9a28451a8807aa67b43"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T14:48:13+00:00",
      "cve": "CVE-2026-80932",
      "id": "CVE-2026-80932",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "262",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vsock/virtio: flush works in dependency order",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80932.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:06:12Z",
      "cve": "CVE-2026-80932",
      "id": "CVE-2026-80932",
      "initial_release_date": "2026-09-12T16:37:26Z",
      "product_status:known_affected": "347",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80932",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80932.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.