CVE-2026-97995 Linux CVE debrief

Who should care

Linux kernel developers, administrators responsible for maintaining and securing Linux-based systems, and security teams should assess exposure and apply necessary updates to prevent potential slab-out-of-bounds access. This involves reviewing kernel versions, updating affected systems, and verifying the effectiveness of the updates. Additionally, operators and platform administrators should be aware of the potential impacts on system stability and take

Why it matters

The Linux kernel's virtio_console vulnerability requires assessment and patching to prevent potential system instability or exploitation.

• Potential slab-out-of-bounds access can lead to system crashes or instability
• Exploitation attempts may be made against unpatched systems
• Verification of kernel versions and updates is necessary

Technical summary

The Linux kernel's virtio_console has a vulnerability that can cause slab-out-of-bounds access when a control message is still on c_ovq during device unbinding. This occurs because __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie, which remove_vqs() walks and passes to free_buf(). If a control message remains on c_ovq when the device is unbound, free_buf() reads past the ports_device object, potentially leading to system crashes or instability. To address this, Linux kernel developers and administrators should assess exposure and apply necessary updates.

Defensive priority

Assess and apply kernel updates to prevent potential slab-out-of-bounds access.

Recommended defensive actions

• Assess exposure to the Linux kernel virtio_console vulnerability
• Apply kernel updates to address the slab-out-of-bounds issue
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue arises from __send_control_msg() publishing &portdev->cpkt as the control-out virtqueue cookie, which remove_vqs() walks and passes to free_buf(). If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store. The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it. This requires assessment,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.