CVE-2026-97988

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vhost: invalidate vring access on IOTLB transitions

When VIRTIO_F_ACCESS_PLATFORM changes, cached vring pointers and IOTLB

metadata are interpreted in a different address space. Keeping them

across the transition can leave stale ring mappings in use.

Clearing d->iotlb before taking the VQ locks also lets a worker observe

a transient NULL d->iotlb and fall back to d->umem while translating a

descriptor.

Add a common vhost_clear_device_iotlb() helper for vhost-net and

vhost-vsock. Take all VQ mutexes in index order before dropping the

device-wide IOTLB, invalidate each VQ's cached ring access and metadata,

clear pending IOTLB messages, and free the old table after the handoff.

This serializes the transition with workers and prevents mixed address

space mappings.

On the first direct-to-IOTLB transition, invalidate the cached vring

addresses. When an existing device IOTLB is replaced, preserve the

GIOVA ring addresses

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References