CVE-2026-97995

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97995
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97995.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97995
Downstream
Published
2026-09-25T10:23:26Z
Modified
2026-09-26T03:48:31Z
Summary
virtio_console: do not free control-out buffers on remove
Details

In the Linux kernel, the following vulnerability has been resolved:

virtio_console: do not free control-out buffers on remove

__send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages.

If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object.

KASAN reported slab-out-of-bounds in free_buf():

free_buf
remove_vqs
virtcons_remove
unbind_store

The object was the ports_device allocated in virtcons_probe().

Drain c_ovq without freeing. The packet lives in portdev and is released with it.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97995.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b
Fixed
177ee901aa2bab02e7f1f8edbb814fd5e386ed62
Fixed
a80c33488e0bbe642ed803b13a4ac8078a70b507
Fixed
f620c40ea6862feed84deb105568b21ec53a7830
Fixed
894f98e73983f37354214a89a3a7fd35bf9e3072
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
f92b16b815efe8207090a9b5a767618fd89542ca
Last Affected
d2bbfac82b7942afc5d8e564d7087835280df495
Last Affected
a88e13d9a092fbb772d380944b44eb549ef131fe
Last Affected
dd807a784fd36f4136516d5858efb6473dda422c
Last Affected
47cb14192bcbba3f15b1c3561e05e084e56fdef6
Last Affected
6b1c41a0f7183702abb7a104c6c7e196ad69a6b3
Last Affected
9037306163a6ba5587e4b5ca511ac7be4fb7295b
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3.16.60
Fixed
3.17
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3.18.108
Fixed
3.19
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.1.52
Fixed
4.2
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.4.131
Fixed
4.5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.9.98
Fixed
4.10
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.14.39
Fixed
4.15
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.16.7
Fixed
4.17

Affected versions

v2.*
v2.6.12-rc2
v2.6.12-rc3
v2.6.12-rc4
v2.6.13
v2.6.13-rc1
v2.6.13-rc2
v2.6.13-rc3
v2.6.13-rc4
v2.6.13-rc5
v2.6.13-rc6
v2.6.13-rc7
v2.6.14-rc1
v2.6.14-rc2
v2.6.14-rc3
v2.6.15-rc1
v2.6.15-rc2
v2.6.15-rc4
v2.6.15-rc5
v2.6.15-rc7
v2.6.16
v2.6.16-rc1
v2.6.16-rc2
v2.6.16-rc3
v2.6.16-rc4
v2.6.16-rc5
v2.6.16-rc6
v2.6.17
v2.6.17-rc1
v2.6.17-rc2
v2.6.17-rc3
v2.6.17-rc4
v2.6.17-rc5
v2.6.17-rc6
v2.6.18
v2.6.18-rc1
v2.6.18-rc2
v2.6.18-rc3
v2.6.18-rc5
v2.6.18-rc6
v2.6.19-rc1
v2.6.19-rc2
v2.6.20-rc1
v2.6.20-rc2
v2.6.20-rc3
v2.6.20-rc4
v2.6.20-rc5
v2.6.20-rc6
v2.6.20-rc7
v2.6.21
v2.6.21-rc1
v2.6.21-rc2
v2.6.21-rc3
v2.6.21-rc4
v2.6.21-rc5
v2.6.21-rc6
v2.6.21-rc7
v2.6.22
v2.6.22-rc1
v2.6.22-rc2
v2.6.22-rc3
v2.6.22-rc4
v2.6.22-rc5
v2.6.22-rc6
v2.6.22-rc7
v2.6.23
v2.6.23-rc1
v2.6.23-rc2
v2.6.23-rc3
v2.6.23-rc4
v2.6.23-rc5
v2.6.23-rc6
v2.6.23-rc7
v2.6.23-rc8
v2.6.23-rc9
v2.6.24
v2.6.24-rc1
v2.6.24-rc2
v2.6.24-rc3
v2.6.24-rc4
v2.6.24-rc5
v2.6.24-rc6
v2.6.24-rc7
v2.6.24-rc8
v2.6.25
v2.6.25-rc1
v2.6.25-rc2
v2.6.25-rc3
v2.6.25-rc4
v2.6.25-rc5
v2.6.25-rc6
v2.6.25-rc7
v2.6.25-rc8
v2.6.25-rc9
v2.6.26
v2.6.26-rc1
v2.6.26-rc2
v2.6.26-rc3
v2.6.26-rc4
v2.6.26-rc5
v2.6.26-rc6
v2.6.26-rc7
v2.6.26-rc8
v2.6.26-rc9
v2.6.27
v2.6.27-rc1
v2.6.27-rc2
v2.6.27-rc3
v2.6.27-rc4
v2.6.27-rc5
v2.6.27-rc6
v2.6.27-rc7
v2.6.27-rc8
v2.6.27-rc9
v2.6.28
v2.6.28-rc1
v2.6.28-rc2
v2.6.28-rc3
v2.6.28-rc4
v2.6.28-rc5
v2.6.28-rc6
v2.6.28-rc7
v2.6.28-rc8
v2.6.28-rc9
v2.6.29
v2.6.29-rc1
v2.6.29-rc2
v2.6.29-rc3
v2.6.29-rc4
v2.6.29-rc5
v2.6.29-rc6
v2.6.29-rc7
v2.6.29-rc8
v2.6.30
v2.6.30-rc1
v2.6.30-rc2
v2.6.30-rc3
v2.6.30-rc4
v2.6.30-rc5
v2.6.30-rc6
v2.6.30-rc7
v2.6.30-rc8
v2.6.31
v2.6.31-rc1
v2.6.31-rc2
v2.6.31-rc3
v2.6.31-rc4
v2.6.31-rc5
v2.6.31-rc6
v2.6.31-rc7
v2.6.31-rc8
v2.6.31-rc9
v2.6.32
v2.6.32-rc1
v2.6.32-rc2
v2.6.32-rc3
v2.6.32-rc4
v2.6.32-rc5
v2.6.32-rc6
v2.6.32-rc7
v2.6.32-rc8
v2.6.33
v2.6.33-rc1
v2.6.33-rc2
v2.6.33-rc3
v2.6.33-rc4
v2.6.33-rc5
v2.6.33-rc6
v2.6.33-rc7
v2.6.33-rc8
v2.6.34
v2.6.34-rc1
v2.6.34-rc2
v2.6.34-rc3
v2.6.34-rc4
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v2.6.35
v2.6.35-rc1
v2.6.35-rc2
v2.6.35-rc3
v2.6.35-rc4
v2.6.35-rc5
v2.6.35-rc6
v2.6.36
v2.6.36-rc1
v2.6.36-rc2
v2.6.36-rc3
v2.6.36-rc4
v2.6.36-rc5
v2.6.36-rc6
v2.6.36-rc7
v2.6.36-rc8
v2.6.37
v2.6.37-rc1
v2.6.37-rc2
v2.6.37-rc3
v2.6.37-rc4
v2.6.37-rc5
v2.6.37-rc6
v2.6.37-rc7
v2.6.37-rc8
v2.6.38
v2.6.38-rc1
v2.6.38-rc2
v2.6.38-rc3
v2.6.38-rc4
v2.6.38-rc5
v2.6.38-rc6
v2.6.38-rc7
v2.6.38-rc8
v2.6.39
v2.6.39-rc1
v2.6.39-rc2
v2.6.39-rc3
v2.6.39-rc4
v2.6.39-rc5
v2.6.39-rc6
v2.6.39-rc7
v3.*
v3.0
v3.0-rc1
v3.0-rc2
v3.0-rc3
v3.0-rc4
v3.0-rc5
v3.0-rc6
v3.0-rc7
v3.1
v3.1-rc1
v3.1-rc10
v3.1-rc2
v3.1-rc3
v3.1-rc4
v3.1-rc5
v3.1-rc6
v3.1-rc7
v3.1-rc8
v3.1-rc9
v3.10
v3.10-rc1
v3.10-rc2
v3.10-rc3
v3.10-rc4
v3.10-rc5
v3.10-rc6
v3.10-rc7
v3.11
v3.11-rc1
v3.11-rc2
v3.11-rc3
v3.11-rc4
v3.11-rc5
v3.11-rc6
v3.11-rc7
v3.12
v3.12-rc1
v3.12-rc2
v3.12-rc3
v3.12-rc4
v3.12-rc5
v3.12-rc6
v3.12-rc7
v3.13
v3.13-rc1
v3.13-rc2
v3.13-rc3
v3.13-rc4
v3.13-rc5
v3.13-rc6
v3.13-rc7
v3.13-rc8
v3.14
v3.14-rc1
v3.14-rc2
v3.14-rc3
v3.14-rc4
v3.14-rc5
v3.14-rc6
v3.14-rc7
v3.14-rc8
v3.15
v3.15-rc1
v3.15-rc2
v3.15-rc3
v3.15-rc4
v3.15-rc5
v3.15-rc6
v3.15-rc7
v3.15-rc8
v3.16
v3.16-rc1
v3.16-rc2
v3.16-rc3
v3.16-rc4
v3.16-rc5
v3.16-rc6
v3.16-rc7
v3.16.1
v3.16.2
v3.16.3
v3.16.35
v3.16.36
v3.16.37
v3.16.38
v3.16.39
v3.16.4
v3.16.40
v3.16.41
v3.16.42
v3.16.43
v3.16.44
v3.16.45
v3.16.46
v3.16.47
v3.16.48
v3.16.49
v3.16.5
v3.16.50
v3.16.51
v3.16.52
v3.16.53
v3.16.54
v3.16.55
v3.16.56
v3.16.57
v3.16.58
v3.16.59
v3.16.6
v3.16.7
v3.17
v3.17-rc1
v3.17-rc2
v3.17-rc3
v3.17-rc4
v3.17-rc5
v3.17-rc6
v3.17-rc7
v3.18
v3.18-rc1
v3.18-rc2
v3.18-rc3
v3.18-rc4
v3.18-rc5
v3.18-rc6
v3.18-rc7
v3.18.1
v3.18.10
v3.18.100
v3.18.101
v3.18.102
v3.18.103
v3.18.104
v3.18.105
v3.18.106
v3.18.107
v3.18.11
v3.18.12
v3.18.13
v3.18.14
v3.18.15
v3.18.16
v3.18.17
v3.18.18
v3.18.19
v3.18.2
v3.18.20
v3.18.21
v3.18.22
v3.18.23
v3.18.24
v3.18.25
v3.18.26
v3.18.27
v3.18.28
v3.18.29
v3.18.3
v3.18.30
v3.18.31
v3.18.32
v3.18.33
v3.18.34
v3.18.35
v3.18.36
v3.18.37
v3.18.38
v3.18.39
v3.18.4
v3.18.40
v3.18.41
v3.18.42
v3.18.43
v3.18.44
v3.18.45
v3.18.46
v3.18.47
v3.18.48
v3.18.49
v3.18.5
v3.18.50
v3.18.51
v3.18.52
v3.18.53
v3.18.54
v3.18.55
v3.18.56
v3.18.57
v3.18.58
v3.18.59
v3.18.6
v3.18.60
v3.18.61
v3.18.62
v3.18.63
v3.18.64
v3.18.65
v3.18.66
v3.18.67
v3.18.68
v3.18.69
v3.18.7
v3.18.70
v3.18.71
v3.18.72
v3.18.73
v3.18.74
v3.18.75
v3.18.76
v3.18.77
v3.18.78
v3.18.79
v3.18.8
v3.18.80
v3.18.81
v3.18.82
v3.18.83
v3.18.84
v3.18.85
v3.18.86
v3.18.87
v3.18.88
v3.18.89
v3.18.9
v3.18.90
v3.18.91
v3.18.92
v3.18.93
v3.18.94
v3.18.95
v3.18.96
v3.18.97
v3.18.98
v3.18.99
v3.19
v3.19-rc1
v3.19-rc2
v3.19-rc3
v3.19-rc4
v3.19-rc5
v3.19-rc6
v3.19-rc7
v3.2
v3.2-rc1
v3.2-rc2
v3.2-rc3
v3.2-rc4
v3.2-rc5
v3.2-rc6
v3.2-rc7
v3.3
v3.3-rc1
v3.3-rc2
v3.3-rc3
v3.3-rc4
v3.3-rc5
v3.3-rc6
v3.3-rc7
v3.4
v3.4-rc1
v3.4-rc2
v3.4-rc3
v3.4-rc4
v3.4-rc5
v3.4-rc6
v3.4-rc7
v3.5
v3.5-rc1
v3.5-rc2
v3.5-rc3
v3.5-rc4
v3.5-rc5
v3.5-rc6
v3.5-rc7
v3.6
v3.6-rc1
v3.6-rc2
v3.6-rc3
v3.6-rc4
v3.6-rc5
v3.6-rc6
v3.6-rc7
v3.7
v3.7-rc1
v3.7-rc2
v3.7-rc3
v3.7-rc4
v3.7-rc5
v3.7-rc6
v3.7-rc7
v3.7-rc8
v3.8
v3.8-rc1
v3.8-rc2
v3.8-rc3
v3.8-rc4
v3.8-rc5
v3.8-rc6
v3.8-rc7
v3.9
v3.9-rc1
v3.9-rc2
v3.9-rc3
v3.9-rc4
v3.9-rc5
v3.9-rc6
v3.9-rc7
v3.9-rc8
v4.*
v4.0
v4.0-rc1
v4.0-rc2
v4.0-rc3
v4.0-rc4
v4.0-rc5
v4.0-rc6
v4.0-rc7
v4.1
v4.1-rc1
v4.1-rc2
v4.1-rc3
v4.1-rc4
v4.1-rc5
v4.1-rc6
v4.1-rc7
v4.1-rc8
v4.1.1
v4.1.10
v4.1.11
v4.1.12
v4.1.13
v4.1.14
v4.1.15
v4.1.16
v4.1.17
v4.1.18
v4.1.19
v4.1.2
v4.1.20
v4.1.21
v4.1.22
v4.1.23
v4.1.24
v4.1.25
v4.1.26
v4.1.27
v4.1.28
v4.1.29
v4.1.3
v4.1.30
v4.1.31
v4.1.32
v4.1.33
v4.1.34
v4.1.35
v4.1.36
v4.1.37
v4.1.38
v4.1.39
v4.1.4
v4.1.40
v4.1.41
v4.1.42
v4.1.43
v4.1.44
v4.1.45
v4.1.46
v4.1.47
v4.1.48
v4.1.49
v4.1.5
v4.1.50
v4.1.51
v4.1.6
v4.1.7
v4.1.8
v4.1.9
v4.10
v4.10-rc1
v4.10-rc2
v4.10-rc3
v4.10-rc4
v4.10-rc5
v4.10-rc6
v4.10-rc7
v4.10-rc8
v4.11
v4.11-rc1
v4.11-rc2
v4.11-rc3
v4.11-rc4
v4.11-rc5
v4.11-rc6
v4.11-rc7
v4.11-rc8
v4.12
v4.12-rc1
v4.12-rc2
v4.12-rc3
v4.12-rc4
v4.12-rc5
v4.12-rc6
v4.12-rc7
v4.13
v4.13-rc1
v4.13-rc2
v4.13-rc3
v4.13-rc4
v4.13-rc5
v4.13-rc6
v4.13-rc7
v4.14
v4.14-rc1
v4.14-rc2
v4.14-rc3
v4.14-rc4
v4.14-rc5
v4.14-rc6
v4.14-rc7
v4.14-rc8
v4.14.1
v4.14.10
v4.14.11
v4.14.12
v4.14.13
v4.14.14
v4.14.15
v4.14.16
v4.14.17
v4.14.18
v4.14.19
v4.14.2
v4.14.20
v4.14.21
v4.14.22
v4.14.23
v4.14.24
v4.14.25
v4.14.26
v4.14.27
v4.14.28
v4.14.29
v4.14.3
v4.14.30
v4.14.31
v4.14.32
v4.14.33
v4.14.34
v4.14.35
v4.14.36
v4.14.37
v4.14.38
v4.14.4
v4.14.5
v4.14.6
v4.14.7
v4.14.8
v4.14.9
v4.15
v4.15-rc1
v4.15-rc2
v4.15-rc3
v4.15-rc4
v4.15-rc5
v4.15-rc6
v4.15-rc7
v4.15-rc8
v4.15-rc9
v4.16
v4.16-rc1
v4.16-rc2
v4.16-rc3
v4.16-rc4
v4.16-rc5
v4.16-rc6
v4.16-rc7
v4.16.1
v4.16.2
v4.16.3
v4.16.4
v4.16.5
v4.16.6
v4.2
v4.2-rc1
v4.2-rc2
v4.2-rc3
v4.2-rc4
v4.2-rc5
v4.2-rc6
v4.2-rc7
v4.2-rc8
v4.3
v4.3-rc1
v4.3-rc2
v4.3-rc3
v4.3-rc4
v4.3-rc5
v4.3-rc6
v4.3-rc7
v4.4
v4.4-rc1
v4.4-rc2
v4.4-rc3
v4.4-rc4
v4.4-rc5
v4.4-rc6
v4.4-rc7
v4.4-rc8
v4.4.1
v4.4.10
v4.4.100
v4.4.101
v4.4.102
v4.4.103
v4.4.104
v4.4.105
v4.4.106
v4.4.107
v4.4.108
v4.4.109
v4.4.11
v4.4.110
v4.4.111
v4.4.112
v4.4.113
v4.4.114
v4.4.115
v4.4.116
v4.4.117
v4.4.118
v4.4.119
v4.4.12
v4.4.120
v4.4.121
v4.4.122
v4.4.123
v4.4.124
v4.4.125
v4.4.126
v4.4.127
v4.4.128
v4.4.129
v4.4.13
v4.4.130
v4.4.14
v4.4.15
v4.4.16
v4.4.17
v4.4.18
v4.4.19
v4.4.2
v4.4.20
v4.4.21
v4.4.22
v4.4.23
v4.4.24
v4.4.25
v4.4.26
v4.4.27
v4.4.28
v4.4.29
v4.4.3
v4.4.30
v4.4.31
v4.4.32
v4.4.33
v4.4.34
v4.4.35
v4.4.36
v4.4.37
v4.4.38
v4.4.39
v4.4.4
v4.4.40
v4.4.41
v4.4.42
v4.4.43
v4.4.44
v4.4.45
v4.4.46
v4.4.47
v4.4.48
v4.4.49
v4.4.5
v4.4.50
v4.4.51
v4.4.52
v4.4.53
v4.4.54
v4.4.55
v4.4.56
v4.4.57
v4.4.58
v4.4.59
v4.4.6
v4.4.60
v4.4.61
v4.4.62
v4.4.63
v4.4.64
v4.4.65
v4.4.66
v4.4.67
v4.4.68
v4.4.69
v4.4.7
v4.4.70
v4.4.71
v4.4.72
v4.4.73
v4.4.74
v4.4.75
v4.4.76
v4.4.77
v4.4.78
v4.4.79
v4.4.8
v4.4.80
v4.4.81
v4.4.82
v4.4.83
v4.4.84
v4.4.85
v4.4.86
v4.4.87
v4.4.88
v4.4.89
v4.4.9
v4.4.90
v4.4.91
v4.4.92
v4.4.93
v4.4.94
v4.4.95
v4.4.96
v4.4.97
v4.4.98
v4.4.99
v4.5
v4.5-rc1
v4.5-rc2
v4.5-rc3
v4.5-rc4
v4.5-rc5
v4.5-rc6
v4.5-rc7
v4.6
v4.6-rc1
v4.6-rc2
v4.6-rc3
v4.6-rc4
v4.6-rc5
v4.6-rc6
v4.6-rc7
v4.7
v4.7-rc1
v4.7-rc2
v4.7-rc3
v4.7-rc4
v4.7-rc5
v4.7-rc6
v4.7-rc7
v4.8
v4.8-rc1
v4.8-rc2
v4.8-rc3
v4.8-rc4
v4.8-rc5
v4.8-rc6
v4.8-rc7
v4.8-rc8
v4.9
v4.9-rc1
v4.9-rc2
v4.9-rc3
v4.9-rc4
v4.9-rc5
v4.9-rc6
v4.9-rc7
v4.9-rc8
v4.9.1
v4.9.10
v4.9.11
v4.9.12
v4.9.13
v4.9.14
v4.9.15
v4.9.16
v4.9.17
v4.9.18
v4.9.19
v4.9.2
v4.9.20
v4.9.21
v4.9.22
v4.9.23
v4.9.24
v4.9.25
v4.9.26
v4.9.27
v4.9.28
v4.9.29
v4.9.3
v4.9.30
v4.9.31
v4.9.32
v4.9.33
v4.9.34
v4.9.35
v4.9.36
v4.9.37
v4.9.38
v4.9.39
v4.9.4
v4.9.40
v4.9.41
v4.9.42
v4.9.43
v4.9.44
v4.9.45
v4.9.46
v4.9.47
v4.9.48
v4.9.49
v4.9.5
v4.9.50
v4.9.51
v4.9.52
v4.9.53
v4.9.54
v4.9.55
v4.9.56
v4.9.57
v4.9.58
v4.9.59
v4.9.6
v4.9.60
v4.9.61
v4.9.62
v4.9.63
v4.9.64
v4.9.65
v4.9.66
v4.9.67
v4.9.68
v4.9.69
v4.9.7
v4.9.70
v4.9.71
v4.9.72
v4.9.73
v4.9.74
v4.9.75
v4.9.76
v4.9.77
v4.9.78
v4.9.79
v4.9.8
v4.9.80
v4.9.81
v4.9.82
v4.9.83
v4.9.84
v4.9.85
v4.9.86
v4.9.87
v4.9.88
v4.9.89
v4.9.9
v4.9.90
v4.9.91
v4.9.92
v4.9.93
v4.9.94
v4.9.95
v4.9.96
v4.9.97

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97995.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.17.0
Fixed
6.12.111
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.53
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97995.json"