In the Linux kernel, the following vulnerability has been resolved:
vmci_host: fix a race condition in vmci_host_poll() causing GPF
During fuzzing, a general protection fault is observed in vmci_host_poll().
general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926 <- omitting registers -> Call Trace: <TASK> lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162 add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22 poll_wait include/linux/poll.h:49 [inline] vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174 vfs_poll include/linux/poll.h:88 [inline] do_pollfd fs/select.c:873 [inline] do_poll fs/select.c:921 [inline] do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015 __do_sys_ppoll fs/select.c:1121 [inline] __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x46/0xb0
Example thread interleaving that causes the general protection fault is as follows:
CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context) ----- ----- // Read uninitialized context context = vmci_host_dev->context; // Initialize context vmci_host_dev->context = vmci_ctx_create(); vmci_host_dev->ct_type = VMCIOBJ_CONTEXT;
if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { // Dereferencing the wrong pointer poll_wait(..., &context->host_context); }
In this scenario, vmci_host_poll() reads vmci_host_dev->context first, and then reads vmci_host_dev->ct_type to check that vmci_host_dev->context is initialized. However, since these two reads are not atomically executed, there is a chance of a race condition as described above.
To fix this race condition, read vmci_host_dev->context after checking the value of vmci_host_dev->ct_type so that vmci_host_poll() always reads an initialized context.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.10.184-174.730Upgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade kernel-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-livepatch-5.15.117-72.142Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-develUpgrade kernelUpgrade kernel-headers | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernelUpgrade kernel-livepatch-6.1.29-47.49Upgrade perfUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-develUpgrade kernel-libbpf-staticUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade perf-debuginfoUpgrade kernel-debuginfo | Feb 20, 2026 | Dec 24, 2025 |
| Debian | — | Upgrade linux | Dec 29, 2025 | Dec 29, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 24, 2025 |
| Ubuntu | — | Upgrade linux-lowlatencyUpgrade linux-xilinx-zynqmpUpgrade linux-azure-fipsUpgrade linux-gcpUpgrade linux-nvidiaUpgrade linux-ibm-5.15Upgrade linux-ibm-5.4Upgrade linux-hwe-5.4Upgrade linux-nvidia-tegra-igxUpgrade linux-intel-iot-realtimeUpgrade linux-nvidia-tegraUpgrade linux-ibmUpgrade linux-gkeopUpgrade linux-azure-fde-5.15Upgrade linux-gcp-5.4Upgrade linux-gcp-fipsUpgrade linux-azure-5.15Upgrade linux-aws-fipsUpgrade linuxUpgrade linux-oracle-5.15Upgrade linux-aws-5.15Upgrade linux-gcp-5.15Upgrade linux-riscv-5.15Upgrade linux-aws-5.4Upgrade linux-lowlatency-hwe-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-hwe-5.15Upgrade linux-awsUpgrade linux-azure-5.4Upgrade linux-raspi-5.4Upgrade linux-intel-iotgUpgrade linux-raspiUpgrade linux-intel-iotg-5.15Upgrade linux-iotUpgrade linux-kvmUpgrade linux-realtimeUpgrade linux-gkeUpgrade linux-azureUpgrade linux-oracle-5.4Upgrade linux-oracleUpgrade linux-bluefieldUpgrade linux-fips | Jan 6, 2026 | Dec 24, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub