CVE-2026-97995virtio_console: do not free control-out buffers on remove
- —Not scoredno CVSS score yet
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.
Timeline
ID reserved
By Linux
Published
- 24 days later
· 24 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b – < b1f39c2a676698cc64c8e105e08b25111a112ec6
- affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b – < e03522a990cd2e0f1a736eaa349a9df9ab8541c3
- affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b – < 8f6cfc3eca79b8e108d0823756101e2f4f9d811f
- affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b – < 2e40c69b9c3448b9c6609cd02013da593b2e123b
- affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b – < 177ee901aa2bab02e7f1f8edbb814fd5e386ed62
- affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b – < a80c33488e0bbe642ed803b13a4ac8078a70b507
- affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b – < f620c40ea6862feed84deb105568b21ec53a7830
- affected a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b – < 894f98e73983f37354214a89a3a7fd35bf9e3072
- affected f92b16b815efe8207090a9b5a767618fd89542ca
- affected d2bbfac82b7942afc5d8e564d7087835280df495
- affected a88e13d9a092fbb772d380944b44eb549ef131fe
- affected dd807a784fd36f4136516d5858efb6473dda422c
- affected 47cb14192bcbba3f15b1c3561e05e084e56fdef6
- affected 6b1c41a0f7183702abb7a104c6c7e196ad69a6b3
- affected 9037306163a6ba5587e4b5ca511ac7be4fb7295b
- affected 3.16.60 – < 3.17
- affected 3.18.108 – < 3.19
- affected 4.1.52 – < 4.2
- affected 4.4.131 – < 4.5
- affected 4.9.98 – < 4.10
- affected 4.14.39 – < 4.15
- affected 4.16.7 – < 4.17
- affected 4.17
- unaffected < 4.17
- unaffected 5.10.271 – ≤ 5.10.*
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.111 – ≤ 6.12.*
- unaffected 6.18.53 – ≤ 6.18.*
- unaffected 7.2.7 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/b1f39c2a676698cc64c8e105e08b25111a112ec6 (opens in a new tab)
- https://git.kernel.org/stable/c/e03522a990cd2e0f1a736eaa349a9df9ab8541c3 (opens in a new tab)
- https://git.kernel.org/stable/c/8f6cfc3eca79b8e108d0823756101e2f4f9d811f (opens in a new tab)
- https://git.kernel.org/stable/c/2e40c69b9c3448b9c6609cd02013da593b2e123b (opens in a new tab)
- https://git.kernel.org/stable/c/177ee901aa2bab02e7f1f8edbb814fd5e386ed62 (opens in a new tab)
- https://git.kernel.org/stable/c/a80c33488e0bbe642ed803b13a4ac8078a70b507 (opens in a new tab)
- https://git.kernel.org/stable/c/f620c40ea6862feed84deb105568b21ec53a7830 (opens in a new tab)
- https://git.kernel.org/stable/c/894f98e73983f37354214a89a3a7fd35bf9e3072 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-86649 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-97995)Record last updated .