# CVE-2025-21756: vsock: Keep the binding until socket destruction

> A use-after-free vulnerability in the Linux kernel vsock subsystem allows local attackers to execute arbitrary code or escalate privileges.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 27 Feb 2025
- **Updated:** 15 Oct 2026
- **Also known as:** A-396331793, ASB-A-396331793, AZL-58995, AZL-59037, BELL-CVE-2025-21756, DEBIAN-CVE-2025-21756, GHSA-5828-2c94-235c, RHSA-2025:8058, UBUNTU-CVE-2025-21756

## What is CVE-2025-21756?

CVE-2025-21756 is a high-severity use after free vulnerability in Linux kernel, published on 27 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

vsock: Keep the binding until socket destruction

Preserve sockets bindings; this includes both resulting from an explicit
bind() and those implicitly bound through autobind during connect().

Prevents socket unbinding during a transport reassignment, which fixes a
use-after-free:

    1. vsock_create() (refcnt=1) calls vsock_insert_unbound() (refcnt=2)
    2. transport->release() calls vsock_remove_bound() without checking if
       sk was bound and moved to bound list (refcnt=1)
    3. vsock_bind() assumes sk is in unbound list and before
       __vsock_insert_bound(vsock_bound_sockets()) calls
       __vsock_remove_bound() which does:
           list_del_init(&vsk->bound_table); // nop
           sock_put(&vsk->sk);               // refcnt=0

BUG: KASAN: slab-use-after-free in __vsock_bind+0x62e/0x730
Read of size 4 at addr ffff88816b46a74c by task a.out/2057
 dump_stack_lvl+0x68/0x90
 print_report+0x174/0x4f6
 kasan_report+0xb9/0x190
 __vsock_bind+0x62e/0x730
 vsock_bind+0x97/0xe0
 __sys_bind+0x154/0x1f0
 __x64_sys_bind+0x6e/0xb0
 do_syscall_64+0x93/0x1b0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Allocated by task 2057:
 kasan_save_stack+0x1e/0x40
 kasan_save_track+0x10/0x30
 __kasan_slab_alloc+0x85/0x90
 kmem_cache_alloc_noprof+0x131/0x450
 sk_prot_alloc+0x5b/0x220
 sk_alloc+0x2c/0x870
 __vsock_create.constprop.0+0x2e/0xb60
 vsock_create+0xe4/0x420
 __sock_create+0x241/0x650
 __sys_socket+0xf2/0x1a0
 __x64_sys_socket+0x6e/0xb0
 do_syscall_64+0x93/0x1b0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Freed by task 2057:
 kasan_save_stack+0x1e/0x40
 kasan_save_track+0x10/0x30
 kasan_save_free_info+0x37/0x60
 __kasan_slab_free+0x4b/0x70
 kmem_cache_free+0x1a1/0x590
 __sk_destruct+0x388/0x5a0
 __vsock_bind+0x5e1/0x730
 vsock_bind+0x97/0xe0
 __sys_bind+0x154/0x1f0
 __x64_sys_bind+0x6e/0xb0
 do_syscall_64+0x93/0x1b0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

refcount_t: addition on 0; use-after-free.
WARNING: CPU: 7 PID: 2057 at lib/refcount.c:25 refcount_warn_saturate+0xce/0x150
RIP: 0010:refcount_warn_saturate+0xce/0x150
 __vsock_bind+0x66d/0x730
 vsock_bind+0x97/0xe0
 __sys_bind+0x154/0x1f0
 __x64_sys_bind+0x6e/0xb0
 do_syscall_64+0x93/0x1b0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

refcount_t: underflow; use-after-free.
WARNING: CPU: 7 PID: 2057 at lib/refcount.c:28 refcount_warn_saturate+0xee/0x150
RIP: 0010:refcount_warn_saturate+0xee/0x150
 vsock_remove_bound+0x187/0x1e0
 __vsock_release+0x383/0x4a0
 vsock_release+0x90/0x120
 __sock_release+0xa3/0x250
 sock_close+0x14/0x20
 __fput+0x359/0xa80
 task_work_run+0x107/0x1d0
 do_exit+0x847/0x2560
 do_group_exit+0xb8/0x250
 __x64_sys_exit_group+0x3a/0x50
 x64_sys_call+0xfec/0x14f0
 do_syscall_64+0x93/0x1b0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Weakness: CWE-416 (Use After Free)

## Which versions are affected by CVE-2025-21756?

It affects 1 product.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `bpftool-debuginfo` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:7.3.0-427.68.2.el9_4 |
| `kernel-64k-debug-debuginfo` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-64k-debug-devel` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-64k-debug-devel-matched` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-64k-debuginfo` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-64k-devel` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-64k-devel-matched` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-debug-debuginfo` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-debug-devel` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-debug-devel-matched` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-debuginfo` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-debuginfo-common-aarch64` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-debuginfo-common-ppc64le` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-debuginfo-common-s390x` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-debuginfo-common-x86_64` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-devel` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-devel-matched` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-doc` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-rt-debug-debuginfo` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-rt-debuginfo` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-tools-debuginfo` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-zfcpdump-debuginfo` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-zfcpdump-devel` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-zfcpdump-devel-matched` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `libperf-debuginfo` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `perf` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `perf-debuginfo` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `python3-perf-debuginfo` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `rtla` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `rv` | Red Hat:rhel_eus:9.4::appstream | All versions | 0:5.14.0-427.68.2.el9_4 |
| `bpftool` | Red Hat:rhel_eus:9.4::baseos | All versions | 0:7.3.0-427.68.2.el9_4 |
| `bpftool-debuginfo` | Red Hat:rhel_eus:9.4::baseos | All versions | 0:7.3.0-427.68.2.el9_4 |
| `kernel` | Red Hat:rhel_eus:9.4::baseos | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-64k` | Red Hat:rhel_eus:9.4::baseos | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-64k-core` | Red Hat:rhel_eus:9.4::baseos | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-64k-debug` | Red Hat:rhel_eus:9.4::baseos | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-64k-debug-core` | Red Hat:rhel_eus:9.4::baseos | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-64k-debug-debuginfo` | Red Hat:rhel_eus:9.4::baseos | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-64k-debug-modules` | Red Hat:rhel_eus:9.4::baseos | All versions | 0:5.14.0-427.68.2.el9_4 |
| `kernel-64k-debug-modules-core` | Red Hat:rhel_eus:9.4::baseos | All versions | 0:5.14.0-427.68.2.el9_4 |

Products: Linux kernel.

## How do I fix CVE-2025-21756?

Apply the vendor's patch.

## Is CVE-2025-21756 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-21756 exists.

Public exploit code:

- Exploit for CVE-2025-21756 for Linux kernel 6.6.75. My first linux kernel exploit! (github_poc): https://github.com/hoefler02/CVE-2025-21756
- https://github.com/khoatran107/cve-2025-21756 (github_poc): https://github.com/khoatran107/cve-2025-21756
- CVE-2025-21756: Attack of the Vsock (github_poc): https://github.com/h3raklez/CVE-2025-21756
- Reproduce CVE-2022-32250 and CVE-2025-21756 by tampering with modprobe_path and hijacking control flow, respectively. (github_poc): https://github.com/KuanKuanQAQ/cve-testing

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-21756 and fix it if it is affected.

What it is: CVE-2025-21756 is a high-severity use after free vulnerability in Linux kernel, published on 27 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-21756 exists.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-21756/ (Markdown: https://insights.sbomify.com/CVE-2025-21756/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-21756
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-21756
- OSV: https://osv.dev/vulnerability/CVE-2025-21756

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-21756/
Summaries are generated and may contain mistakes; the official description above is the record.