All vulnerabilities
CVE-2026-97995

Linux: virtio_console: do not free control-out buffers on remove

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8f6cfc3eca79b8e108d0823756101e2f4f9d811fAlso 2e40c69b9c3448b9c6609cd02013da593b2e123b, 177ee901aa2bab02e7f1f8edbb814fd5e386ed62 and 8 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 8f6cfc3eca79b8e108d0823756101e2f4f9d811fLinuxCVE List
  • 2e40c69b9c3448b9c6609cd02013da593b2e123bLinuxCVE List
  • 177ee901aa2bab02e7f1f8edbb814fd5e386ed62LinuxCVE List
  • 894f98e73983f37354214a89a3a7fd35bf9e3072LinuxCVE List
  • 3.17LinuxCVE List
  • 3.19LinuxCVE List
Show all 11 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

virtio_console: do not free control-out buffers on remove

__send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages.

If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object.

KASAN reported slab-out-of-bounds in free_buf():

free_buf remove_vqs virtcons_remove unbind_store

The object was the ports_device allocated in virtcons_probe().

Drain c_ovq without freeing. The packet lives in portdev and is released with it.

Text from CVE List

Affected versions 32

  • Linuxaffected: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before b1f39c2a676698cc64c8e105e08b25111a112ec6CVE List
  • Linuxaffected: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before e03522a990cd2e0f1a736eaa349a9df9ab8541c3CVE List
  • Linuxaffected: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before 8f6cfc3eca79b8e108d0823756101e2f4f9d811fCVE List
  • Linuxaffected: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before 2e40c69b9c3448b9c6609cd02013da593b2e123bCVE List
  • Linuxaffected: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before 177ee901aa2bab02e7f1f8edbb814fd5e386ed62CVE List
  • Linuxaffected: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before a80c33488e0bbe642ed803b13a4ac8078a70b507CVE List
  • Linuxaffected: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before f620c40ea6862feed84deb105568b21ec53a7830CVE List
  • Linuxaffected: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before 894f98e73983f37354214a89a3a7fd35bf9e3072CVE List
  • Linuxaffected: f92b16b815efe8207090a9b5a767618fd89542caCVE List
  • Linuxaffected: d2bbfac82b7942afc5d8e564d7087835280df495CVE List
  • Linuxaffected: a88e13d9a092fbb772d380944b44eb549ef131feCVE List
  • Linuxaffected: dd807a784fd36f4136516d5858efb6473dda422cCVE List
  • Linuxaffected: 47cb14192bcbba3f15b1c3561e05e084e56fdef6CVE List
  • Linuxaffected: 6b1c41a0f7183702abb7a104c6c7e196ad69a6b3CVE List
  • Linuxaffected: 9037306163a6ba5587e4b5ca511ac7be4fb7295bCVE List
  • Linuxaffected: 3.16.60 before 3.17CVE List
  • Linuxaffected: 3.18.108 before 3.19CVE List
  • Linuxaffected: 4.1.52 before 4.2CVE List
  • Linuxaffected: 4.4.131 before 4.5CVE List
  • Linuxaffected: 4.9.98 before 4.10CVE List
  • Linuxaffected: 4.14.39 before 4.15CVE List
  • Linuxaffected: 4.16.7 before 4.17CVE List
  • Linuxaffected: 4.17CVE List
  • Linuxunaffected: all versions before 4.17CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8