CVE-2026-74311

In the Linux kernel, the following vulnerability has been resolved:

virtio: rtc: tear down old virtqueues before restore

virtiodevicerestore() resets the device and restores the negotiated features before calling ->restore(). viortcfreeze() intentionally leaves the existing virtqueues in place so the alarm queue can still wake the system, but viortcrestore() immediately calls viortcinitvqs() without first deleting those old queues.

If virtqueue reinitialization fails on virtio-pci, the transport error path can run vpdelvqs() against a newly allocated vpdev->vqs array while vdev->vqs still contains the old virtqueues. vpdelvqs() then looks up queue state through the new array and can dereference a NULL info pointer in vpdel_vq(), crashing the guest kernel during restore.

This can also happen during a non-faulty reinitialization, when one of the vpfindvqs_msix() attempts is unsuccessful before a later attempt would succeed.

Delete the stale virtqueues before rebuilding them. If restore fails before virtiodeviceready(), reuse the remove path to stop the device. Once the device is ready, return errors directly instead of deleting the virtqueues again.