Strix
64.9K

CVE-2026-97995

Unknown

Last modified

CVE-2026-97995 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing.

Description

In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b, < 177ee901aa2bab02e7f1f8edbb814fd5e386ed62; >= a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b, < a80c33488e0bbe642ed803b13a4ac8078a70b507; >= a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b, < f620c40ea6862feed84deb105568b21ec53a7830; >= a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b, < 894f98e73983f37354214a89a3a7fd35bf9e3072; f92b16b815efe8207090a9b5a767618fd89542ca; d2bbfac82b7942afc5d8e564d7087835280df495; a88e13d9a092fbb772d380944b44eb549ef131fe; dd807a784fd36f4136516d5858efb6473dda422c; 47cb14192bcbba3f15b1c3561e05e084e56fdef6; 6b1c41a0f7183702abb7a104c6c7e196ad69a6b3; 9037306163a6ba5587e4b5ca511ac7be4fb7295b; >= 3.16.60, < 3.17; >= 3.18.108, < 3.19; >= 4.1.52, < 4.2; >= 4.4.131, < 4.5; >= 4.9.98, < 4.10; >= 4.14.39, < 4.15; >= 4.16.7, < 4.17
LinuxLinux4.17

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-97995?
In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.
How severe is CVE-2026-97995?
Severity scoring for CVE-2026-97995 is pending analysis.
How do I fix CVE-2026-97995?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-97995?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST