CVE-2026-97995

virtio_console: do not free control-out buffers on remove

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

virtio_console: do not free control-out buffers on remove

__send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages.

If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object.

KASAN reported slab-out-of-bounds in free_buf():

free_buf remove_vqs virtcons_remove unbind_store

The object was the ports_device allocated in virtcons_probe().

Drain c_ovq without freeing. The packet lives in portdev and is released with it.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before b1f39c2a676698cc64c8e105e08b25111a112ec6Affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before e03522a990cd2e0f1a736eaa349a9df9ab8541c3Affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before 8f6cfc3eca79b8e108d0823756101e2f4f9d811fAffected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before 2e40c69b9c3448b9c6609cd02013da593b2e123bAffected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before 177ee901aa2bab02e7f1f8edbb814fd5e386ed62Affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before a80c33488e0bbe642ed803b13a4ac8078a70b507Affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before f620c40ea6862feed84deb105568b21ec53a7830Affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before 894f98e73983f37354214a89a3a7fd35bf9e3072Affected f92b16b815efe8207090a9b5a767618fd89542caAffected d2bbfac82b7942afc5d8e564d7087835280df495Affected a88e13d9a092fbb772d380944b44eb549ef131feAffected dd807a784fd36f4136516d5858efb6473dda422cAffected 47cb14192bcbba3f15b1c3561e05e084e56fdef6Affected 6b1c41a0f7183702abb7a104c6c7e196ad69a6b3Affected 9037306163a6ba5587e4b5ca511ac7be4fb7295bAffected 3.16.60 to before 3.17Affected 3.18.108 to before 3.19Affected 4.1.52 to before 4.2Affected 4.4.131 to before 4.5Affected 4.9.98 to before 4.10Affected 4.14.39 to before 4.15Affected 4.16.7 to before 4.17Affected
LinuxLinux	4.17Affected before 4.17Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before b1f39c2a676698cc64c8e105e08b25111a112ec6Affected
a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before e03522a990cd2e0f1a736eaa349a9df9ab8541c3Affected
a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before 8f6cfc3eca79b8e108d0823756101e2f4f9d811fAffected
a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before 2e40c69b9c3448b9c6609cd02013da593b2e123bAffected
a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before 177ee901aa2bab02e7f1f8edbb814fd5e386ed62Affected
a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before a80c33488e0bbe642ed803b13a4ac8078a70b507Affected
a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before f620c40ea6862feed84deb105568b21ec53a7830Affected
a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b to before 894f98e73983f37354214a89a3a7fd35bf9e3072Affected
f92b16b815efe8207090a9b5a767618fd89542caAffected
d2bbfac82b7942afc5d8e564d7087835280df495Affected
a88e13d9a092fbb772d380944b44eb549ef131feAffected
dd807a784fd36f4136516d5858efb6473dda422cAffected
47cb14192bcbba3f15b1c3561e05e084e56fdef6Affected
6b1c41a0f7183702abb7a104c6c7e196ad69a6b3Affected
9037306163a6ba5587e4b5ca511ac7be4fb7295bAffected
3.16.60 to before 3.17Affected
3.18.108 to before 3.19Affected
4.1.52 to before 4.2Affected
4.4.131 to before 4.5Affected
4.9.98 to before 4.10Affected
4.14.39 to before 4.15Affected
4.16.7 to before 4.17Affected

LinuxLinux

4.17Affected
before 4.17Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.