CVE-2026-97995 PUBLISHED

virtio_console: do not free control-out buffers on remove

Assigner: Linux
Reserved: 25.09.2026 Published: 25.09.2026 Updated: 25.09.2026

In the Linux kernel, the following vulnerability has been resolved:

virtio_console: do not free control-out buffers on remove

__send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages.

If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object.

KASAN reported slab-out-of-bounds in free_buf():

<pre>free_buf remove_vqs virtcons_remove unbind_store </pre>

The object was the ports_device allocated in virtcons_probe().

Drain c_ovq without freeing. The packet lives in portdev and is released with it.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to 177ee901aa2bab02e7f1f8edbb814fd5e386ed62 (excl.)
  • affected from a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to a80c33488e0bbe642ed803b13a4ac8078a70b507 (excl.)
  • affected from a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to f620c40ea6862feed84deb105568b21ec53a7830 (excl.)
  • affected from a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to 894f98e73983f37354214a89a3a7fd35bf9e3072 (excl.)
  • Version f92b16b815efe8207090a9b5a767618fd89542ca is affected
  • Version d2bbfac82b7942afc5d8e564d7087835280df495 is affected
  • Version a88e13d9a092fbb772d380944b44eb549ef131fe is affected
  • Version dd807a784fd36f4136516d5858efb6473dda422c is affected
  • Version 47cb14192bcbba3f15b1c3561e05e084e56fdef6 is affected
  • Version 6b1c41a0f7183702abb7a104c6c7e196ad69a6b3 is affected
  • Version 9037306163a6ba5587e4b5ca511ac7be4fb7295b is affected
  • affected from 3.16.60 to 3.17 (excl.)
  • affected from 3.18.108 to 3.19 (excl.)
  • affected from 4.1.52 to 4.2 (excl.)
  • affected from 4.4.131 to 4.5 (excl.)
  • affected from 4.9.98 to 4.10 (excl.)
  • affected from 4.14.39 to 4.15 (excl.)
  • affected from 4.16.7 to 4.17 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 4.17 is affected
  • unaffected from 0 to 4.17 (excl.)
  • unaffected from 6.12.111 to 6.12.* (incl.)
  • unaffected from 6.18.53 to 6.18.* (incl.)
  • unaffected from 7.2.7 to 7.2.* (incl.)
  • unaffected from 7.3-rc3 to * (incl.)

References