virtio_console: do not free control-out buffers on remove (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.18 % · percentile 7 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.
References
- https://git.kernel.org/stable/c/b1f39c2a676698cc64c8e105e08b25111a112ec6
- https://git.kernel.org/stable/c/e03522a990cd2e0f1a736eaa349a9df9ab8541c3
- https://git.kernel.org/stable/c/8f6cfc3eca79b8e108d0823756101e2f4f9d811f
- https://git.kernel.org/stable/c/2e40c69b9c3448b9c6609cd02013da593b2e123b
- https://git.kernel.org/stable/c/177ee901aa2bab02e7f1f8edbb814fd5e386ed62
- https://git.kernel.org/stable/c/a80c33488e0bbe642ed803b13a4ac8078a70b507
- https://git.kernel.org/stable/c/f620c40ea6862feed84deb105568b21ec53a7830
- https://git.kernel.org/stable/c/894f98e73983f37354214a89a3a7fd35bf9e3072
European references
- ENISA EUVD · EUVD-2026-86649
- GCVE · GCVE-0-2026-97995
CERT-FR advisories
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b < b1f39c2a676698cc64c8e105e08b25111a112ec6 ; affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b < e03522a990cd2e0f1a736eaa349a9df9ab8541c3 ; affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b < 8f6cfc3eca79b8e108d0823756101e2f4f9d811f ; affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b < 2e40c69b9c3448b9c6609cd02013da593b2e123b ; affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b < 177ee901aa2bab02e7f1f8edbb814fd5e386ed62 ; affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b < a80c33488e0bbe642ed803b13a4ac8078a70b507 |
| Linux · Linux | affected 4.17 ; unaffected 0 < 4.17 ; unaffected 5.10.271 ≤ 5.10.* ; unaffected 5.15.222 ≤ 5.15.* ; unaffected 6.1.189 ≤ 6.1.* ; unaffected 6.6.158 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |