CVE-2026-97995

Summary

In the Linux kernel, the following vulnerability has been resolved:

virtio_console: do not free control-out buffers on remove

__send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages.

If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object.

KASAN reported slab-out-of-bounds in free_buf():

free_buf
remove_vqs
virtcons_remove
unbind_store

The object was the ports_device allocated in virtcons_probe().

Drain c_ovq without freeing. The packet lives in portdev and is released with it.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxa7a69ec0d8e4a58be7db88d33cbfa2912807bb2b < 177ee901aa2bab02e7f1f8edbb814fd5e386ed62affected
LinuxLinuxa7a69ec0d8e4a58be7db88d33cbfa2912807bb2b < a80c33488e0bbe642ed803b13a4ac8078a70b507affected
LinuxLinuxa7a69ec0d8e4a58be7db88d33cbfa2912807bb2b < f620c40ea6862feed84deb105568b21ec53a7830affected
LinuxLinuxa7a69ec0d8e4a58be7db88d33cbfa2912807bb2b < 894f98e73983f37354214a89a3a7fd35bf9e3072affected
LinuxLinuxf92b16b815efe8207090a9b5a767618fd89542caaffected
LinuxLinuxd2bbfac82b7942afc5d8e564d7087835280df495affected
LinuxLinuxa88e13d9a092fbb772d380944b44eb549ef131feaffected
LinuxLinuxdd807a784fd36f4136516d5858efb6473dda422caffected
LinuxLinux47cb14192bcbba3f15b1c3561e05e084e56fdef6affected
LinuxLinux6b1c41a0f7183702abb7a104c6c7e196ad69a6b3affected
LinuxLinux9037306163a6ba5587e4b5ca511ac7be4fb7295baffected
LinuxLinux3.16.60 < 3.17affected
LinuxLinux3.18.108 < 3.19affected
LinuxLinux4.1.52 < 4.2affected
LinuxLinux4.4.131 < 4.5affected
LinuxLinux4.9.98 < 4.10affected
LinuxLinux4.14.39 < 4.15affected
LinuxLinux4.16.7 < 4.17affected
LinuxLinux4.17affected
LinuxLinux0 < 4.17unaffected
LinuxLinux6.12.111 <= 6.12.*unaffected
LinuxLinux6.18.53 <= 6.18.*unaffected
LinuxLinux7.2.7 <= 7.2.*unaffected
LinuxLinux7.3-rc3 <= *unaffected

Weaknesses

References