FKIE_CVE-2026-97995

Vulnerability from fkie_nvd - Published: 2026-09-25 11:17 - Updated: 2026-09-25 11:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/177ee901aa2bab02e7f1f8edbb814fd5e386ed62
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/894f98e73983f37354214a89a3a7fd35bf9e3072
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a80c33488e0bbe642ed803b13a4ac8078a70b507
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f620c40ea6862feed84deb105568b21ec53a7830
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/virtio_console.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "177ee901aa2bab02e7f1f8edbb814fd5e386ed62",
              "status": "affected",
              "version": "a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b",
              "versionType": "git"
            },
            {
              "lessThan": "a80c33488e0bbe642ed803b13a4ac8078a70b507",
              "status": "affected",
              "version": "a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b",
              "versionType": "git"
            },
            {
              "lessThan": "f620c40ea6862feed84deb105568b21ec53a7830",
              "status": "affected",
              "version": "a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b",
              "versionType": "git"
            },
            {
              "lessThan": "894f98e73983f37354214a89a3a7fd35bf9e3072",
              "status": "affected",
              "version": "a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f92b16b815efe8207090a9b5a767618fd89542ca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d2bbfac82b7942afc5d8e564d7087835280df495",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a88e13d9a092fbb772d380944b44eb549ef131fe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dd807a784fd36f4136516d5858efb6473dda422c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "47cb14192bcbba3f15b1c3561e05e084e56fdef6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6b1c41a0f7183702abb7a104c6c7e196ad69a6b3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9037306163a6ba5587e4b5ca511ac7be4fb7295b",
              "versionType": "git"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.60",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.108",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.52",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.131",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.98",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.39",
              "versionType": "semver"
            },
            {
              "lessThan": "4.17",
              "status": "affected",
              "version": "4.16.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/virtio_console.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_console: do not free control-out buffers on remove\n\n__send_control_msg() publishes \u0026portdev-\u003ecpkt as the control-out\nvirtqueue cookie. remove_vqs() walks every virtqueue and passes leftover\ncookies to free_buf(), which treats them as struct port_buffer and\nreads sgpages.\n\nIf a control message is still on c_ovq when the device is unbound,\nfree_buf() reads past the ports_device object.\n\nKASAN reported slab-out-of-bounds in free_buf():\n\n\tfree_buf\n\tremove_vqs\n\tvirtcons_remove\n\tunbind_store\n\nThe object was the ports_device allocated in virtcons_probe().\n\nDrain c_ovq without freeing. The packet lives in portdev and is released\nwith it."
    }
  ],
  "id": "CVE-2026-97995",
  "lastModified": "2026-09-25T11:17:27.750",
  "metrics": {},
  "published": "2026-09-25T11:17:27.750",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/177ee901aa2bab02e7f1f8edbb814fd5e386ed62"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/894f98e73983f37354214a89a3a7fd35bf9e3072"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a80c33488e0bbe642ed803b13a4ac8078a70b507"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f620c40ea6862feed84deb105568b21ec53a7830"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.