---
id: CVE-2026-97995
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  virtio_console: do not free control-out buffers on remove

  __send_control_msg() publishes &portdev->cpkt as the control-out
  virtqueue cookie
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  virtio_console: do not free control-out buffers on remove

  __send_control_msg() publishes &portdev->cpkt as the control-out
  virtqueue cookie. remove_vqs() walks every v…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b <
    177ee901aa2bab02e7f1f8edbb814fd5e386ed62
  - >-
    Linux >= a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b <
    a80c33488e0bbe642ed803b13a4ac8078a70b507
  - >-
    Linux >= a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b <
    f620c40ea6862feed84deb105568b21ec53a7830
  - >-
    Linux >= a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b <
    894f98e73983f37354214a89a3a7fd35bf9e3072
  - Linux f92b16b815efe8207090a9b5a767618fd89542ca
  - Linux d2bbfac82b7942afc5d8e564d7087835280df495
  - Linux a88e13d9a092fbb772d380944b44eb549ef131fe
  - Linux dd807a784fd36f4136516d5858efb6473dda422c
  - Linux 47cb14192bcbba3f15b1c3561e05e084e56fdef6
  - Linux 6b1c41a0f7183702abb7a104c6c7e196ad69a6b3
  - Linux 9037306163a6ba5587e4b5ca511ac7be4fb7295b
  - Linux >= 3.16.60 < 3.17
  - Linux >= 3.18.108 < 3.19
  - Linux >= 4.1.52 < 4.2
  - Linux >= 4.4.131 < 4.5
  - Linux >= 4.9.98 < 4.10
  - Linux >= 4.14.39 < 4.15
  - Linux >= 4.16.7 < 4.17
  - Linux 4.17
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:27.750'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97995'
references:
  - url: 'https://git.kernel.org/stable/c/177ee901aa2bab02e7f1f8edbb814fd5e386ed62'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/894f98e73983f37354214a89a3a7fd35bf9e3072'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a80c33488e0bbe642ed803b13a4ac8078a70b507'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f620c40ea6862feed84deb105568b21ec53a7830'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.864Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

virtio_console: do not free control-out buffers on remove

__send_control_msg() publishes &portdev->cpkt as the control-out
virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover
cookies to free_buf(), which treats them as struct port_buffer and
reads sgpages.

If a control message is still on c_ovq when the device is unbound,
free_buf() reads past the ports_device object.

KASAN reported slab-out-of-bounds in free_buf():

	free_buf
	remove_vqs
	virtcons_remove
	unbind_store

The object was the ports_device allocated in virtcons_probe().

Drain c_ovq without freeing. The packet lives in portdev and is released
with it.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.