Answer in brief
CVE-2026-97995 records a Unknown severity vulnerability in virtio_console: do not free control-out buffers on remove. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b <177ee901aa2bab02e7f1f8edbb814fd5e386ed62 || >=a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b <a80c33488e0bbe642ed803b13a4ac8078a70b507 || >=a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b <f620c40ea6862feed84deb105568b21ec53a7830 || >=a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b <894f98e73983f37354214a89a3a7fd35bf9e3072 || f92b16b815efe8207090a9b5a767618fd89542ca || d2bbfac82b7942afc5d8e564d7087835280df495 || a88e13d9a092fbb772d380944b44eb549ef131fe || dd807a784fd36f4136516d5858efb6473dda422c || 47cb14192bcbba3f15b1c3561e05e084e56fdef6 || 6b1c41a0f7183702abb7a104c6c7e196ad69a6b3 || 9037306163a6ba5587e4b5ca511ac7be4fb7295b || >=3.16.60 <3.17 || >=3.18.108 <3.19 || >=4.1.52 <4.2 || >=4.4.131 <4.5 || >=4.9.98 <4.10 || >=4.14.39 <4.15 || >=4.16.7 <4.17 | 177ee901aa2bab02e7f1f8edbb814fd5e386ed62, a80c33488e0bbe642ed803b13a4ac8078a70b507, f620c40ea6862feed84deb105568b21ec53a7830, 894f98e73983f37354214a89a3a7fd35bf9e3072, 3.17, 3.19, 4.2, 4.5, 4.10, 4.15, 4.17 |
| Linux/Linuxgeneric | 4.17 | Not reported |
Published upstream
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 25, 2026
In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.
Quoted source text, attributed separately from HOL analysis.