Out-of-bounds read in Linux kernel - CVE-2026-97995

Vulnerability details

The vulnerability allows a local privileged user to cause an out-of-bounds read.

The vulnerability exists due to type confusion in the virtio_console remove_vqs() function when unbinding a device with a control message remaining on the control-out virtqueue. A local privileged user can unbind the device while the control message is queued to cause an out-of-bounds read.

Affected software

How to mitigate CVE-2026-97995

External References

• https://git.kernel.org/stable/c/177ee901aa2bab02e7f1f8edbb814fd5e386ed62
• https://git.kernel.org/stable/c/894f98e73983f37354214a89a3a7fd35bf9e3072
• https://git.kernel.org/stable/c/a80c33488e0bbe642ed803b13a4ac8078a70b507
• https://git.kernel.org/stable/c/f620c40ea6862feed84deb105568b21ec53a7830

Related Security Bulletins

• Out-of-bounds read in Linux kernel char driver