CVE-2026-97995
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
virtio_console: do not free control-out buffers on remove
In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b | affected | git | b1f39c2a676698cc64c8e105e08b25111a112ec6 | Unavailable | None listed |
| a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b | affected | git | e03522a990cd2e0f1a736eaa349a9df9ab8541c3 | Unavailable | None listed |
| a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b | affected | git | 8f6cfc3eca79b8e108d0823756101e2f4f9d811f | Unavailable | None listed |
| a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b | affected | git | 2e40c69b9c3448b9c6609cd02013da593b2e123b | Unavailable | None listed |
| a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b | affected | git | 177ee901aa2bab02e7f1f8edbb814fd5e386ed62 | Unavailable | None listed |
| a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b | affected | git | a80c33488e0bbe642ed803b13a4ac8078a70b507 | Unavailable | None listed |
| a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b | affected | git | f620c40ea6862feed84deb105568b21ec53a7830 | Unavailable | None listed |
| a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b | affected | git | 894f98e73983f37354214a89a3a7fd35bf9e3072 | Unavailable | None listed |
| f92b16b815efe8207090a9b5a767618fd89542ca | affected | git | Unavailable | Unavailable | None listed |
| d2bbfac82b7942afc5d8e564d7087835280df495 | affected | git | Unavailable | Unavailable | None listed |
| a88e13d9a092fbb772d380944b44eb549ef131fe | affected | git | Unavailable | Unavailable | None listed |
| dd807a784fd36f4136516d5858efb6473dda422c | affected | git | Unavailable | Unavailable | None listed |
| 47cb14192bcbba3f15b1c3561e05e084e56fdef6 | affected | git | Unavailable | Unavailable | None listed |
| 6b1c41a0f7183702abb7a104c6c7e196ad69a6b3 | affected | git | Unavailable | Unavailable | None listed |
| 9037306163a6ba5587e4b5ca511ac7be4fb7295b | affected | git | Unavailable | Unavailable | None listed |
| 3.16.60 | affected | semver | 3.17 | Unavailable | None listed |
| 3.18.108 | affected | semver | 3.19 | Unavailable | None listed |
| 4.1.52 | affected | semver | 4.2 | Unavailable | None listed |
| 4.4.131 | affected | semver | 4.5 | Unavailable | None listed |
| 4.9.98 | affected | semver | 4.10 | Unavailable | None listed |
| 4.14.39 | affected | semver | 4.15 | Unavailable | None listed |
| 4.16.7 | affected | semver | 4.17 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4.17 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 4.17 | Unavailable | None listed |
| 5.10.271 | unaffected | semver | Unavailable | 5.10.* | None listed |
| 5.15.222 | unaffected | semver | Unavailable | 5.15.* | None listed |
| 6.1.189 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.158 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.111 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.53 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.7 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |