CVE-2026-97995 (GCVE-0-2026-97995)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-19 09:12
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.
References
Impacted products
Vendor Product Version
Linux Linux Version: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b
Version: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b
Version: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b
Version: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b
Version: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b
Version: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b
Version: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b
Version: a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b
Version: f92b16b815efe8207090a9b5a767618fd89542ca
Version: d2bbfac82b7942afc5d8e564d7087835280df495
Version: a88e13d9a092fbb772d380944b44eb549ef131fe
Version: dd807a784fd36f4136516d5858efb6473dda422c
Version: 47cb14192bcbba3f15b1c3561e05e084e56fdef6
Version: 6b1c41a0f7183702abb7a104c6c7e196ad69a6b3
Version: 9037306163a6ba5587e4b5ca511ac7be4fb7295b
Version: 3.16.60   ≤
Version: 3.18.108   ≤
Version: 4.1.52   ≤
Version: 4.4.131   ≤
Version: 4.9.98   ≤
Version: 4.14.39   ≤
Version: 4.16.7   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/virtio_console.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b1f39c2a676698cc64c8e105e08b25111a112ec6",
              "status": "affected",
              "version": "a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b",
              "versionType": "git"
            },
            {
              "lessThan": "e03522a990cd2e0f1a736eaa349a9df9ab8541c3",
              "status": "affected",
              "version": "a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b",
              "versionType": "git"
            },
            {
              "lessThan": "8f6cfc3eca79b8e108d0823756101e2f4f9d811f",
              "status": "affected",
              "version": "a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b",
              "versionType": "git"
            },
            {
              "lessThan": "2e40c69b9c3448b9c6609cd02013da593b2e123b",
              "status": "affected",
              "version": "a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b",
              "versionType": "git"
            },
            {
              "lessThan": "177ee901aa2bab02e7f1f8edbb814fd5e386ed62",
              "status": "affected",
              "version": "a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b",
              "versionType": "git"
            },
            {
              "lessThan": "a80c33488e0bbe642ed803b13a4ac8078a70b507",
              "status": "affected",
              "version": "a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b",
              "versionType": "git"
            },
            {
              "lessThan": "f620c40ea6862feed84deb105568b21ec53a7830",
              "status": "affected",
              "version": "a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b",
              "versionType": "git"
            },
            {
              "lessThan": "894f98e73983f37354214a89a3a7fd35bf9e3072",
              "status": "affected",
              "version": "a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f92b16b815efe8207090a9b5a767618fd89542ca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d2bbfac82b7942afc5d8e564d7087835280df495",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a88e13d9a092fbb772d380944b44eb549ef131fe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dd807a784fd36f4136516d5858efb6473dda422c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "47cb14192bcbba3f15b1c3561e05e084e56fdef6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6b1c41a0f7183702abb7a104c6c7e196ad69a6b3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9037306163a6ba5587e4b5ca511ac7be4fb7295b",
              "versionType": "git"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.60",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.108",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.52",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.131",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.98",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.39",
              "versionType": "semver"
            },
            {
              "lessThan": "4.17",
              "status": "affected",
              "version": "4.16.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/virtio_console.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.60",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.108",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.52",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.131",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.98",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.16.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_console: do not free control-out buffers on remove\n\n__send_control_msg() publishes \u0026portdev-\u003ecpkt as the control-out\nvirtqueue cookie. remove_vqs() walks every virtqueue and passes leftover\ncookies to free_buf(), which treats them as struct port_buffer and\nreads sgpages.\n\nIf a control message is still on c_ovq when the device is unbound,\nfree_buf() reads past the ports_device object.\n\nKASAN reported slab-out-of-bounds in free_buf():\n\n\tfree_buf\n\tremove_vqs\n\tvirtcons_remove\n\tunbind_store\n\nThe object was the ports_device allocated in virtcons_probe().\n\nDrain c_ovq without freeing. The packet lives in portdev and is released\nwith it."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:12:02.162Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b1f39c2a676698cc64c8e105e08b25111a112ec6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e03522a990cd2e0f1a736eaa349a9df9ab8541c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f6cfc3eca79b8e108d0823756101e2f4f9d811f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e40c69b9c3448b9c6609cd02013da593b2e123b"
        },
        {
          "url": "https://git.kernel.org/stable/c/177ee901aa2bab02e7f1f8edbb814fd5e386ed62"
        },
        {
          "url": "https://git.kernel.org/stable/c/a80c33488e0bbe642ed803b13a4ac8078a70b507"
        },
        {
          "url": "https://git.kernel.org/stable/c/f620c40ea6862feed84deb105568b21ec53a7830"
        },
        {
          "url": "https://git.kernel.org/stable/c/894f98e73983f37354214a89a3a7fd35bf9e3072"
        }
      ],
      "title": "virtio_console: do not free control-out buffers on remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97995",
    "datePublished": "2026-09-25T10:23:26.307Z",
    "dateReserved": "2026-09-25T10:18:58.209Z",
    "dateUpdated": "2026-10-19T09:12:02.162Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.