CVE-2026-97988
Received Received - Intake

Memory Corruption in Linux Kernel vhost

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vhost: invalidate vring access on IOTLB transitions When VIRTIO_F_ACCESS_PLATFORM changes, cached vring pointers and IOTLB metadata are interpreted in a different address space. Keeping them across the transition can leave stale ring mappings in use. Clearing d->iotlb before taking the VQ locks also lets a worker observe a transient NULL d->iotlb and fall back to d->umem while translating a descriptor. Add a common vhost_clear_device_iotlb() helper for vhost-net and vhost-vsock. Take all VQ mutexes in index order before dropping the device-wide IOTLB, invalidate each VQ's cached ring access and metadata, clear pending IOTLB messages, and free the old table after the handoff. This serializes the transition with workers and prevents mixed address space mappings. On the first direct-to-IOTLB transition, invalidate the cached vring addresses. When an existing device IOTLB is replaced, preserve the GIOVA ring addresses and reset only the metadata cache. After clearing ACCESS_PLATFORM, userspace must configure the vring addresses for the new address mode. vhost_vq_invalidate_access() clears desc, avail, and used together. Treat the VQ as invalidated only when all three are NULL, since a single GIOVA address may legitimately be zero.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97988
EUVD
EUVD-2026-86642

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of vring access during IOTLB transitions when the VIRTIO_F_ACCESS_PLATFORM flag changes. This can lead to stale ring mappings being used, potentially causing memory corruption or privilege escalation. The fix ensures proper synchronization and invalidation of cached vring pointers and metadata during these transitions.

Detection Guidance

This vulnerability is specific to the Linux kernel's vhost subsystem and requires kernel-level inspection. Detection involves checking kernel logs for IOTLB transition errors or examining vhost device states. Commands like dmesg | grep vhost or checking /sys/kernel/debug/tracing/trace_pipe for vhost-related errors may help. No direct network commands are applicable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain unauthorized access to memory, execute arbitrary code, or cause a denial of service. Systems using virtualization with affected vhost devices (vhost-net or vhost-vsock) are at risk, potentially leading to data breaches or system crashes.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles or HIPAA's security requirements. Organizations must patch systems to maintain compliance and prevent potential regulatory penalties.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Reboot the system after patching to ensure the updated kernel is active. Monitor kernel logs for vhost-related errors post-update. If using virtualization, ensure hypervisors and guests are updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97988. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart