CVE-2026-90142

virtio_net: Fix resize of the RX ring

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 21, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

virtio_net: Fix resize of the RX ring

When a AF_XDP socket is attached, the virtnet_rx_resize should resize the rq->xsk_buffs XSK buffer array. Otherwise, when the size grows, the virtnet_rx_resume() causes a write past the end of the array. This is easily reproducable with

ethtool -G ens3 rx 32 ./xdpsock -i eth0 -q 0 -r -z & ethtool -G eth0 rx 256

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568 to before 5c941b5d989a15cdaa987a2c602fb168461c6186Affected e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568 to before 5235abdb760bbd7a6fcecf1890b5160b7a75a9ceAffected e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568 to before 8344c9233c8f77017174d9e280c5a26034d068b6Affected e9f3962441c0a4d6f16c656e6c8aa02a3ccdd568 to before d09c98a6da215bce2173a292e4b95c8de6ea5d51Affected
LinuxLinux	6.11Affected before 6.11Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.