https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:17:30 +0000 https://db.gcve.eu/vuln/cve-2026-97995 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>virtio_console: do not free control-out buffers on remove</p> <p>__send_control_msg() publishes &amp;portdev-&gt;cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages.</p> <p>If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object.</p> <p>KASAN reported slab-out-of-bounds in free_buf():</p> <p>free_buf remove_vqs virtcons_remove unbind_store</p> <p>The object was the ports_device allocated in virtcons_probe().</p> <p>Drain c_ovq without freeing. The packet lives in portdev and is released with it.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>virtio_console: do not free control-out buffers on remove</p> <p>__send_control_msg() publishes &amp;portdev-&gt;cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages.</p> <p>If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object.</p> <p>KASAN reported slab-out-of-bounds in free_buf():</p> <p>free_buf remove_vqs virtcons_remove unbind_store</p> <p>The object was the ports_device allocated in virtcons_probe().</p> <p>Drain c_ovq without freeing. The packet lives in portdev and is released with it.</p> https://db.gcve.eu/vuln/cve-2026-97995