Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-97995

virtio_console: do not free control-out buffers on remove

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 3.17, 3.19, 4.2, 4.5, 4.10, and 9 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b · fixed in b1f39c2a676698cc64c8e105e08b25111a112ec6; From a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b · fixed in e03522a990cd2e0f1a736eaa349a9df9ab8541c3; From a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b · fixed in 8f6cfc3eca79b8e108d0823756101e2f4f9d811f; From a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b · fixed in 2e40c69b9c3448b9c6609cd02013da593b2e123b; From a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b · fixed in 177ee901aa2bab02e7f1f8edbb814fd5e386ed62; From a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b · fixed in a80c33488e0bbe642ed803b13a4ac8078a70b507; From a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b · fixed in f620c40ea6862feed84deb105568b21ec53a7830; From a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b · fixed in 894f98e73983f37354214a89a3a7fd35bf9e3072; From 3.16.60 · fixed in 3.17; From 3.18.108 · fixed in 3.19; From 4.1.52 · fixed in 4.2; From 4.4.131 · fixed in 4.5; From 4.9.98 · fixed in 4.10; From 4.14.39 · fixed in 4.15; From 4.16.7 · fixed in 4.17

  • Linux Linux

    4.17

  • KernelLinux

    From 4.17.0 · fixed in 5.10.271; From 5.11.0 · fixed in 5.15.222; From 5.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53; From 6.19.0 · fixed in 7.2.7

References 8

git.kernel.org