High 7.8Published Aug 15, 2026

CVE-2026-74311virtio: rtc: tear down old virtqueues before restore

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: tear down old virtqueues before restore virtio_device_restore() resets the device and restores the negotiated features before calling ->restore(). viortc_freeze() intentionally leaves the existing virtqueues in place so the alarm queue can still wake the system, but viortc_restore() immediately calls viortc_init_vqs() without first deleting those old queues. If virtqueue reinitialization fails on virtio-pci, the transport error path can run vp_del_vqs() against a newly allocated vp_dev->vqs array while vdev->vqs still contains the old virtqueues. vp_del_vqs() then looks up queue state through the new array and can dereference a NULL info pointer in vp_del_vq(), crashing the guest kernel during restore. This can also happen during a non-faulty reinitialization, when one of the vp_find_vqs_msix() attempts is unsuccessful before a later attempt would succeed. Delete the stale virtqueues before rebuilding them. If restore fails before virtio_device_ready(), reuse the remove path to stop the device. Once the device is ready, return errors directly instead of deleting the virtqueues again.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 0623c759276885c3ae88197ba6fb5c9c6ba8612f before 79366023aa891ca31376021a7bccff6384ca1ff1; from 0623c759276885c3ae88197ba6fb5c9c6ba8612f before aebebd1e9d70b650fc9e877082e0134edcf511da; 0623c759276885c3ae88197ba6fb5c9c6ba8612f builds before 548d2208455f14e6121404c6e30e997bfe0cd264	CNA record

References

https://git.kernel.org/stable/c/79366023aa891ca31376021a7bccff6384ca1ff1
https://git.kernel.org/stable/c/aebebd1e9d70b650fc9e877082e0134edcf511da
https://git.kernel.org/stable/c/548d2208455f14e6121404c6e30e997bfe0cd264

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.