rootpwn

critical · CVSS v3 7.8

CVE-2026-97995

CVE-2026-97995 is a Linux kernel memory-safety flaw in the virtio_console driver. During device removal, leftover control-out virtqueue cook

Overview

CVE-2026-97995 is a Linux kernel memory-safety flaw in the virtio_console driver. During device removal, leftover control-out virtqueue cookies can be misinterpreted as port buffers, causing an out-of-bounds read of the ports_device object. It matters because virtio-console is used in virtualized Linux environments and the bug can be triggered during device unbind.

Description

In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.

Impact

Confidentiality and availability are the primary concerns: an out-of-bounds read may expose kernel memory or cause a crash during virtio-console removal. Integrity impact is not directly established but could be relevant if the read is chained with other kernel bugs. It affects Linux systems that use virtio-console, especially virtual machines or containers where the device can be unbound. Local or guest-adjacent actors with permission to trigger device removal are the most relevant threat model.

Remediation

Apply the kernel fix that drains the control-out virtqueue without freeing the control packet on remove, or update to a patched Linux kernel release. If patching is delayed, restrict local access to virtio-console device management, avoid unbinding virtio-console while control traffic may be pending, and disable unused virtio-console devices. Enable kernel hardening, KASAN/panic monitoring, and alert on virtio_console removal errors.

Risk context

Treat as high priority for affected virtualized Linux deployments because the flaw is critical and can be triggered during normal device removal. CVSS v3 is 7.8 and no EPSS score is provided, so urgency should be driven by exposure of virtio-console and ability to unbind devices.

Affected products

  • Linux kernel
  • virtio_console driver
  • Linux virtual guests using virtio-console

Scores

Severity
critical
CVSS v2
9.7
CVSS v3
7.8
CVSS v4
—
EPSS
—

linux-kernel virtio-console memory-safety out-of-bounds-read device-removal virtualization kernel-hardening

← All CVEs

Related CVEs

critical

CVE-2026-98024

CVE-2026-98024 is a critical flaw in the Linux kernel’s s390/ism subsystem that can corrupt the slab allocator and lead to a use‑after‑free. The bug occurs when folio_put() is incorrectly replaced by kfree() during error handling in ism_alloc_dmb(). It can allow attackers to gain arbitrary code execution or cause a denial of service on affected systems.

View analysis

critical

CVE-2026-98115

The Linux kernel ksmbd component had a critical flaw that allowed session teardown during SMB3 multichannel logoff to leave requests running on multiple connections, potentially causing resource leaks and denial of service. The patch ensures proper draining of sessions and cancellation callbacks. This affects any system running the kernel with ksmbd enabled.

View analysis

critical

CVE-2025-51457

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

View analysis

critical

CVE-2026-95832

Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's shell, because color_control() in kitty/window.py answers a query for an unrecognised field name by placing that field name into the reply, and write_escape_code_to_child() in kitty/screen.c then writes the reply to the pseudoterminal master, where it is not distinguishable from input typed by the user, without neutralising it for the shell that reads it. The payload is reduced to printable ASCII before the field name is echoed, which is the restriction introduced in 0.47.3 as the fix for CVE-2026-54057, and the record and field separators ; and = are consumed as delimiters, but every other printable character survives, which is sufficient to compose a shell command. A newline is available from handle_remote_ssh() in kitty/window.py, which writes the bytes yielded by get_ssh_data() in kittens/ssh/utils.py, the first of which begin with a newline, to the pseudoterminal master before any credential carried in the request is checked. The reply is framed as an OSC sequence carrying the escape code number, the field name, and the literal value ?. This results in execution of an attacker-chosen command with the privileges of the user running the terminal.

View analysis