CVE-2026-53181

In the Linux kernel, the following vulnerability has been resolved:

vsock/vmci: fix sk_ack_backlog leak on failed handshake

When vmci_transport_recv_connecting_server() returns an error,

vmci_transport_recv_listen() calls vsock_remove_pending() but never

calls sk_acceptq_removed(). This leaves sk_ack_backlog incremented

permanently.

Repeated handshake failures (malformed packets, queue pair alloc

failure, event subscribe failure) cause sk_ack_backlog to climb

toward sk_max_ack_backlog. Once it reaches the limit the listener

permanently refuses all new connections with -ECONNREFUSED, a

silent denial of service requiring a process restart to recover.

The two existing sk_acceptq_removed() calls in af_vsock.c do not

cover this path: line 764 checks vsock_is_pending() which returns

false after vsock_remove_pending(), and line 1889 is only reached

on successful accept().

Fix by balancing sk_acceptq_added() with sk_acceptq_removed() on

the error path.