CVE-2026-97995: virtio_console: do not free control-out buffers on remove

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-25 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.

Affected products

Linux kernel: from 3.16.60 before 3.17; from 3.18.108 before 3.19; from 4.1.52 before 4.2; from 4.4.131 before 4.5; from 4.9.98 before 4.10; from 4.14.39 before 4.15 — fixed in 3.17, 3.19, 4.10, 4.15, 4.17, 4.2

How to fix

Upgrade to a fixed version: Linux kernel 3.17, 3.19, 4.10, 4.15. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-97995 or the next vulnerability affects your stack