CVE-2026-97995

Received Received - Intake

Heap-Out-of-Bounds in Linux Kernel virtio_console

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97995

EUVD

EUVD-2026-86649

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of control-out buffers in the virtio_console driver. When a device is removed, leftover control messages in the virtqueue are incorrectly treated as buffer objects and freed, leading to a slab-out-of-bounds memory access. This occurs because free_buf() reads past the allocated ports_device object, potentially causing memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's virtio_console driver and may not have direct network detection methods. Monitor kernel logs for slab-out-of-bounds errors or KASAN reports related to virtio_console. Check if the virtio_console device is bound and if control messages remain pending during device removal.

Impact Analysis

This vulnerability could lead to system instability, crashes, or privilege escalation if exploited. Attackers might trigger the flaw by unbinding the virtio_console device, causing memory corruption that could disrupt services or allow unauthorized access to sensitive data.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel memory corruption issue in the virtio_console driver. It may indirectly impact compliance if exploited to cause system instability or data corruption, but no specific compliance implications are mentioned in the provided context.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Avoid unbinding the virtio_console device while control messages are pending. Ensure proper cleanup of control-out buffers during device removal to prevent slab-out-of-bounds errors.

Hi! I’m here to help you understand CVE-2026-97995. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70