CVE-2026-23143

In the Linux kernel, the following vulnerability has been resolved:

virtionet: Fix misalignment bug in struct virtnetinfo

Use the new TRAILING_OVERLAP() helper to fix a misalignment bug along with the following warning:

drivers/net/virtio_net.c:429:46: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

This helper creates a union between a flexible-array member (FAM) and a set of members that would otherwise follow it (in this case u8 rss_hash_key_data[VIRTIO_NET_RSS_MAX_KEY_SIZE];). This overlays the trailing members (rsshashkeydata) onto the FAM (hashkeydata) while keeping the FAM and the start of MEMBERS aligned. The staticassert() ensures this alignment remains.

Notice that due to tail padding in flexible struct virtio_net_rss_config_trailer, rss_trailer.hash_key_data (at offset 83 in struct virtnetinfo) and rss_hash_key_data (at offset 84 in struct virtnetinfo) are misaligned by one byte. See below:

struct virtionetrssconfigtrailer { __le16 maxtxvq; /* 0 2 / __u8 hashkeylength; / 2 1 / __u8 hashkeydata[]; / 3 0 */

    /* size: 4, cachelines: 1, members: 3 */
    /* padding: 1 */
    /* last cacheline: 4 bytes */

};

struct virtnetinfo { ... struct virtionetrssconfigtrailer rsstrailer; /* 80 4 */

    /* XXX last struct has 1 byte of padding */

    u8                         rss_hash_key_data[40]; /*    84    40 */

... /* size: 832, cachelines: 13, members: 48 / / sum members: 801, holes: 8, sum holes: 31 / / paddings: 2, sum paddings: 5 */ };

After changes, those members are correctly aligned at offset 795:

struct virtnetinfo { ... union { struct virtionetrssconfigtrailer rsstrailer; /* 792 4 */ struct { unsigned char _offsettohashkeydata[3]; /* 792 3 */ u8 rsshashkeydata[40]; /* 795 40 / }; / 792 43 / }; / 792 44 / ... / size: 840, cachelines: 14, members: 47 / / sum members: 801, holes: 8, sum holes: 35 / / padding: 4 / / paddings: 1, sum paddings: 4 / / last cacheline: 8 bytes */ };

As a result, the RSS key passed to the device is shifted by 1 byte: the last byte is cut off, and instead a (possibly uninitialized) byte is added at the beginning.

As a last note struct virtio_net_rss_config_hdr *rss_hdr; is also moved to the end, since it seems those three members should stick around together. :)