CVE-2026-97989

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vduse: validate virtqueue alignment

vduse_validate_config() only checks the upper bound of vq_align. Invalid

values can therefore reach vring_create_virtqueue_map(). The split-ring

helpers use align - 1 as a bit mask, so the alignment must be a non-zero

power of two. A zero value makes vring_size() drop the descriptor and

available-ring part and vring_init() leave the used ring pointer NULL.

The VIRTIO spec requires the used ring to start at an address

aligned to at least 4 bytes. Reject values below VRING_USED_ALIGN_SIZE as

well as non-power-of-two values before they reach the virtio ring helpers.

Opening a virtio-net device created with vq_align=0 triggered:

BUG: KASAN: null-ptr-deref in virtqueue_kick_prepare_split+0xe3/0x100

Read of size 2 at addr 0000000000000000 by task systemd-network/1062

Call Trace (relevant frames):

dump_stack_lvl

print_report

kasan_report

__asan_load2

virtqueue_kick_prepare_split+

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References