In the Linux kernel, the following vulnerability has been resolved:
vsock: Do not allow binding to VMADDRPORTANY
It is possible for a vsock to autobind to VMADDRPORTANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDRPORTANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction).
Modify the check in _vsockbindconnectible() to also prevent binding to VMADDRPORT_ANY.
[
{
"id": "CVE-2025-38618-02ebe3a7",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d73960f0cf03ef1dc9e96ec7a20e538accc26d87"
},
{
"id": "CVE-2025-38618-039543e2",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "__vsock_bind_connectible",
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"length": 852.0,
"function_hash": "169002310476267520799577327237012848551"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44bd006d5c93f6a8f28b106cbae2428c5d0275b7"
},
{
"id": "CVE-2025-38618-1ab9afac",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "__vsock_bind_stream",
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"length": 887.0,
"function_hash": "317819182487369943827217752273956802274"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1a5b1964cef42727668ac0d8532dae4f8c19386"
},
{
"id": "CVE-2025-38618-5073771b",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "__vsock_bind_connectible",
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"length": 852.0,
"function_hash": "169002310476267520799577327237012848551"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32950b1907919be86a7a2697d6f93d57068b3865"
},
{
"id": "CVE-2025-38618-53a64638",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@32950b1907919be86a7a2697d6f93d57068b3865"
},
{
"id": "CVE-2025-38618-5dd13aa2",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c04a2c1ca25b9b23104124d3b2d349d934e302de"
},
{
"id": "CVE-2025-38618-7a55761a",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf86704798c1b9c46fa59dfc2d662f57d1394d79"
},
{
"id": "CVE-2025-38618-7d00ba63",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "__vsock_bind_connectible",
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"length": 852.0,
"function_hash": "169002310476267520799577327237012848551"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d73960f0cf03ef1dc9e96ec7a20e538accc26d87"
},
{
"id": "CVE-2025-38618-7d5c1541",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aba0c94f61ec05315fa7815d21aefa4c87f6a9f4"
},
{
"id": "CVE-2025-38618-9144fc9f",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1a5b1964cef42727668ac0d8532dae4f8c19386"
},
{
"id": "CVE-2025-38618-cab57435",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "__vsock_bind_stream",
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"length": 887.0,
"function_hash": "317819182487369943827217752273956802274"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c04a2c1ca25b9b23104124d3b2d349d934e302de"
},
{
"id": "CVE-2025-38618-e24515be",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "__vsock_bind_connectible",
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"length": 887.0,
"function_hash": "317819182487369943827217752273956802274"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf86704798c1b9c46fa59dfc2d662f57d1394d79"
},
{
"id": "CVE-2025-38618-ee82e7a7",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"line_hashes": [
"313398479619233335172454491864747162399",
"17705837403744105389398506657096709059",
"297942217469772507644689495074536641396",
"97959202599283798676745410015723520173"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44bd006d5c93f6a8f28b106cbae2428c5d0275b7"
},
{
"id": "CVE-2025-38618-f844f163",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "__vsock_bind_connectible",
"file": "net/vmw_vsock/af_vsock.c"
},
"deprecated": false,
"digest": {
"length": 852.0,
"function_hash": "169002310476267520799577327237012848551"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aba0c94f61ec05315fa7815d21aefa4c87f6a9f4"
}
]