Loading vulnerability…
Use-after-free in Linux kernel VMCI resource removal
CVE-2024-46738 is a use-after-free vulnerability in the Linux kernel's VMware Virtual Machine Communication Interface (VMCI) subsystem. The vmci_resource_remove() function identifies resources by their handle's context and resource fields without checking the resource type. Resources of different types can share those fields, allowing removal of the wrong table entry. The intended object can nevertheless be freed, including through vmci_datagram_destroy_handle(), leaving a dangling pointer in vmci_resource_table. Subsequent resource operations can access freed memory. The fix additionally checks the resource type during removal.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability leaves a dangling pointer in the kernel's VMCI resource table and permits subsequent access to freed memory. A KASAN trace demonstrates a four-byte read from freed memory in vmci_handle_is_equal() during resource removal and VMCI context cleanup. Concrete privilege-escalation, information-disclosure, or service-disruption outcomes are not established by the available technical details.
If you can’t patch tonight, do this now.
Where immediate patching is not possible, reduce access by preventing untrusted low-privileged users from obtaining local access to affected systems and disable or avoid use of the VMCI subsystem where operationally feasible. No complete workaround is specified.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the VMCI fix that checks both the resource handle and resource type during removal. For RHEL 9.6 channels covered by RHSA-2026:44385, the fixed kernel version is 5.14.0-570.129.1.el9_6; reboot after installation. Google Container-Optimized OS advisories identify fixed versions 18244.151.88 and 18613.0.66 for their respective release branches; apply the update appropriate to the installed branch. For AlmaLinux 9.2 under TuxCare extended-lifecycle support, apply the affected package updates specified by CLSA-2024:1728936982.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.