Linux kernel vsock use-after-free — fix merged 11 hours before public disclosure.

What the vulnerability is

CVE-2025-21756 is a use-after-free (UAF) defect in the Linux kernel's vsock (virtio socket) subsystem. The vsock layer provides socket-style communication between virtual machines and their hosts; under specific race conditions introduced by a binding-address lifecycle bug, a freed socket object is reachable from a live pointer, allowing an attacker with local execution to corrupt kernel memory and escalate privileges.

CVSS score: 8.8 (Critical). Affected kernels: 5.14 through 6.12-rc6. The kernel commit that closes the race is a two-line fix in net/vmw_vsock/af_vsock.c, adding a missing socket-reference increment before the deferred free path runs.

How ZeroPatch caught it before disclosure

The upstream kernel security mailing list circulates embargoed patch sets to a set of downstream distributors and CI consumers under a coordinated-disclosure window. ZeroPatch sits in that distribution chain for the kernel's stable branch. Eleven hours before the public CVE record was published, the patch landed in the embargoed distribution and ZeroPatch's remediation pipeline fired automatically.

• Dependency graph scan: every customer environment pinned to an affected kernel version was flagged within 90 seconds of the patch landing.
• PR generation: a pull request was minted against each affected repository with the pinned kernel version bumped to the patched tag and a regression test added.
• CI validation: all green runs cleared before the embargo lifted — no customer needed to respond to the public disclosure as an emergency.

Why the 11-hour window matters

Most enterprise patching cycles operate on a weekly or bi-weekly cadence. For a CVSS 8.8 privilege-escalation in the kernel, even a 24-hour window is operationally dangerous in cloud environments where vsock is exposed between the hypervisor and guest. Eleven hours means every patched host was hardened before any public PoC could be constructed or shared.

"The CVE went public and we had already merged. The timeline was the whole story — our on-call didn't even open a ticket."

The remediation loop, plainly

ZeroPatch does not sell threat intelligence. The embargoed patch channel is upstream of us — we sit in it, but so do dozens of distributors. What we supply is the loop: a deterministic dependency graph, a PR-minting pipeline that fires on patch arrival, and a CI harness that validates the fix before the window closes. The intel is the same for everyone in the channel; the loop is the differentiator.

Want to see the loop running on your graph? See how ZeroPatch works.