CVE-2026-97995virtio_console: do not free control-out buffers on remove
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before b1f39c2a676698cc64c8e105e08b25111a112ec6; from a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before e03522a990cd2e0f1a736eaa349a9df9ab8541c3; from a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before 8f6cfc3eca79b8e108d0823756101e2f4f9d811f; from a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before 2e40c69b9c3448b9c6609cd02013da593b2e123b; from a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before 177ee901aa2bab02e7f1f8edbb814fd5e386ed62; from a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before a80c33488e0bbe642ed803b13a4ac8078a70b507; from a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before f620c40ea6862feed84deb105568b21ec53a7830; from a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b before 894f98e73983f37354214a89a3a7fd35bf9e3072; and 14 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/b1f39c2a676698cc64c8e105e08b25111a112ec6
- https://git.kernel.org/stable/c/e03522a990cd2e0f1a736eaa349a9df9ab8541c3
- https://git.kernel.org/stable/c/8f6cfc3eca79b8e108d0823756101e2f4f9d811f
- https://git.kernel.org/stable/c/2e40c69b9c3448b9c6609cd02013da593b2e123b
- https://git.kernel.org/stable/c/177ee901aa2bab02e7f1f8edbb814fd5e386ed62
- https://git.kernel.org/stable/c/a80c33488e0bbe642ed803b13a4ac8078a70b507
- https://git.kernel.org/stable/c/f620c40ea6862feed84deb105568b21ec53a7830
- https://git.kernel.org/stable/c/894f98e73983f37354214a89a3a7fd35bf9e3072
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.