CVE-2026-97995

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

virtio_console: do not free control-out buffers on remove

__send_control_msg() publishes &portdev->cpkt as the control-out

virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover

cookies to free_buf(), which treats them as struct port_buffer and

reads sgpages.

If a control message is still on c_ovq when the device is unbound,

free_buf() reads past the ports_device object.

KASAN reported slab-out-of-bounds in free_buf():

free_buf

remove_vqs

virtcons_remove

unbind_store

The object was the ports_device allocated in virtcons_probe().

Drain c_ovq without freeing. The packet lives in portdev and is released

with it.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References