CVE-2026-97989

Overview

CVE-2026-97989 exposes a missing validation of virtqueue alignment in the Linux kernel, allowing a zero or non‑power‑of‑two alignment to reach virtio ring helpers and trigger a null‑pointer dereference. This flaw can cause kernel crashes when a virtio‑net device is opened, leading to service disruption. The issue is mitigated by ensuring proper alignment values before ring creation.

Description

In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vduse_validate_config() only checks the upper bound of vq_align. Invalid values can therefore reach vring_create_virtqueue_map(). The split-ring helpers use align - 1 as a bit mask, so the alignment must be a non-zero power of two. A zero value makes vring_size() drop the descriptor and available-ring part and vring_init() leave the used ring pointer NULL. The VIRTIO spec requires the used ring to start at an address aligned to at least 4 bytes. Reject values below VRING_USED_ALIGN_SIZE as well as non-power-of-two values before they reach the virtio ring helpers. Opening a virtio-net device created with vq_align=0 triggered: BUG: KASAN: null-ptr-deref in virtqueue_kick_prepare_split+0xe3/0x100 Read of size 2 at addr 0000000000000000 by task systemd-network/1062 Call Trace (relevant frames): dump_stack_lvl print_report kasan_report __asan_load2 virtqueue_kick_prepare_split+0xe3/0x100 virtqueue_kick_prepare+0x40/0x60 try_fill_recv+0x857/0x1250 virtnet_open+0x189/0x460 __dev_open+0x225/0x390 __dev_change_flags+0x368/0x3b0 netif_change_flags+0x56/0xc0 do_setlink.isra.0+0x68c/0x1e30 Validate the value before it reaches the virtio ring helpers.

Impact

The vulnerability results in a denial‑of‑service via kernel panic, impacting availability of virtualized services. It does not directly expose data or allow code execution, but repeated crashes can degrade system reliability and availability for administrators and end users.

Remediation

Apply the kernel patch that validates vq_align to be a non‑zero power of two and at least VRING_USED_ALIGN_SIZE before calling vring_create_virtqueue_map. Update to the latest stable kernel release that includes this fix. For immediate protection, disable or reconfigure virtio‑net devices to use a valid alignment value, and monitor system logs for KASAN or null‑pointer dereference messages.

Risk context

The CVSS v3 score of 5.5 indicates a medium severity flaw. While no EPSS data is available, the potential for kernel crashes in virtualized environments warrants timely patching to prevent availability outages.

Affected products

• Linux kernel
• virtio-net
• KVM
• QEMU
• VMware ESXi
• Hyper-V
• OpenStack
• Proxmox