CVE-2026-97989
Received Received - Intake

Vduse virtqueue alignment validation failure

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vduse_validate_config() only checks the upper bound of vq_align. Invalid values can therefore reach vring_create_virtqueue_map(). The split-ring helpers use align - 1 as a bit mask, so the alignment must be a non-zero power of two. A zero value makes vring_size() drop the descriptor and available-ring part and vring_init() leave the used ring pointer NULL. The VIRTIO spec requires the used ring to start at an address aligned to at least 4 bytes. Reject values below VRING_USED_ALIGN_SIZE as well as non-power-of-two values before they reach the virtio ring helpers. Opening a virtio-net device created with vq_align=0 triggered: BUG: KASAN: null-ptr-deref in virtqueue_kick_prepare_split+0xe3/0x100 Read of size 2 at addr 0000000000000000 by task systemd-network/1062 Call Trace (relevant frames): dump_stack_lvl print_report kasan_report __asan_load2 virtqueue_kick_prepare_split+0xe3/0x100 virtqueue_kick_prepare+0x40/0x60 try_fill_recv+0x857/0x1250 virtnet_open+0x189/0x460 __dev_open+0x225/0x390 __dev_change_flags+0x368/0x3b0 netif_change_flags+0x56/0xc0 do_setlink.isra.0+0x68c/0x1e30 Validate the value before it reaches the virtio ring helpers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97989
EUVD
EUVD-2026-86643

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of virtqueue alignment in the vduse driver. The function vduse_validate_config() only checks the upper bound of vq_align, allowing invalid values to reach vring_create_virtqueue_map(). This can lead to a null-pointer dereference when a virtio-net device with vq_align=0 is opened, causing a kernel crash.

Detection Guidance

This vulnerability may be detected by checking for crashes or null-pointer dereferences in virtqueue operations, particularly when vq_align=0 is used. Monitor kernel logs for KASAN reports or BUG messages related to virtqueue_kick_prepare_split. Check if virtio-net devices are configured with invalid vq_align values.

Impact Analysis

This vulnerability can cause a system crash (kernel panic) when a vulnerable virtio-net device is opened. This may lead to denial-of-service conditions, disrupting network services and potentially causing data loss or system unavailability.

Mitigation Strategies

Apply the Linux kernel patch that validates vq_align values before they reach virtio ring helpers. Ensure vq_align is a non-zero power of two and at least 4 bytes. Avoid using vq_align=0 in virtio-net device configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97989. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart