CVE-2026-64457

In the Linux kernel, the following vulnerability has been resolved:

virtio_pci: fix vq info pointer lookup via wrong index

Unbinding a virtio balloon device:

echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind

triggers a NULL pointer dereference. The dmesg says:

BUG: kernel NULL pointer dereference, address: 0000000000000008
[...]
RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0
Call Trace:
<TASK>
vp_del_vqs+0x121/0x230
remove_common+0x135/0x150
virtballoon_remove+0xee/0x100
virtio_dev_remove+0x3b/0x80
device_release_driver_internal+0x187/0x2c0
unbind_store+0xb9/0xe0
kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180
vfs_write+0x2a9/0x3b0
ksys_write+0x5c/0xd0
do_syscall_64+0x54/0x230
entry_SYSCALL_64_after_hwframe+0x29/0x31
[...]
</TASK>

The virtioballoon device registers 5 queues (inflate, deflate, stats, freepage, reporting) but only the first two are unconditional. The stats, freepage and reporting queues are each conditional on their respective feature bits. When any of these features are absent, the corresponding vqsinfo entry has name == NULL, creating holes in the array.

The root cause is an indexing mismatch introduced when vq info storage was changed to be passed as an argument. vpfindvqsmsix() and vpfindvqsintx() store the info pointer at vpdev->vqs[i], where 'i' is the caller's sparse array index. However, the virtqueue itself gets vq->index assigned from queueidx, a dense index that skips NULL entries. When holes exist, 'i' and queueidx diverge. Later, vpdelvqs() looks up info via vpdev->vqs[vq->index] using the dense index into the sparsely-populated array, and hits NULL.

Fix this by storing info at vpdev->vqs[queueidx] instead of vp_dev->vqs[i], so the store index matches the lookup index (vq->index). Apply the fix to both the MSIX and INTX paths.