Unknown

CVE-2026-97995 — virtio_console: do not free control-out buffers on remove

In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.

Published Sep 25, 2026 · Updated Oct 15, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.2% (30-day exploitation probability)+1

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.18%

ahead of 7% of scored CVEs · Oct 15, 2026

Affects

Linux

CVSS base

—

Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
No fix documented in the sources: reduce exposure and monitor the vendor advisory.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	version dd807a784fd36f4136516d5858efb6473dda422cversion 4.17≥ 4.16.7 and < 4.17≥ 4.14.39 and < 4.15≥ 4.9.98 and < 4.10≥ 4.4.131 and < 4.5≥ 4.1.52 and < 4.2≥ 3.18.108 and < 3.19 and 15 more ≥ 3.16.60 and < 3.17version 9037306163a6ba5587e4b5ca511ac7be4fb7295bversion 6b1c41a0f7183702abb7a104c6c7e196ad69a6b3version 47cb14192bcbba3f15b1c3561e05e084e56fdef6≥ a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b and < b1f39c2a676698cc64c8e105e08b25111a112ec6version a88e13d9a092fbb772d380944b44eb549ef131feversion d2bbfac82b7942afc5d8e564d7087835280df495version f92b16b815efe8207090a9b5a767618fd89542ca≥ a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b and < 894f98e73983f37354214a89a3a7fd35bf9e3072≥ a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b and < f620c40ea6862feed84deb105568b21ec53a7830≥ a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b and < a80c33488e0bbe642ed803b13a4ac8078a70b507≥ a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b and < 177ee901aa2bab02e7f1f8edbb814fd5e386ed62≥ a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b and < 2e40c69b9c3448b9c6609cd02013da593b2e123b≥ a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b and < 8f6cfc3eca79b8e108d0823756101e2f4f9d811f≥ a7a69ec0d8e4a58be7db88d33cbfa2912807bb2b and < e03522a990cd2e0f1a736eaa349a9df9ab8541c3	Vulnerable	CVE Program (cve.org) e CISA ADP

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Not enough vector or weakness data: use the affected application’s logs as a starting point.

application logs

Timeline

What happened to this CVE, newest first.

2026
Record published
Oct 15, 2026
Affected products added · linux/linux
Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
Source status changed · → Received
Oct 15, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 15, 2026 · NIST National Vulnerability Database
CVE published
Sep 25, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

8 on the record

git.kernel.org/stable/c/177ee901aa2bab02e7f1f8edbb814fd5e386ed62
NIST National Vulnerability Database
git.kernel.org/stable/c/b1f39c2a676698cc64c8e105e08b25111a112ec6
NIST National Vulnerability Database
git.kernel.org/stable/c/f620c40ea6862feed84deb105568b21ec53a7830
NIST National Vulnerability Database
git.kernel.org/stable/c/8f6cfc3eca79b8e108d0823756101e2f4f9d811f
NIST National Vulnerability Database
git.kernel.org/stable/c/894f98e73983f37354214a89a3a7fd35bf9e3072
NIST National Vulnerability Database
git.kernel.org/stable/c/a80c33488e0bbe642ed803b13a4ac8078a70b507
NIST National Vulnerability Database
git.kernel.org/stable/c/e03522a990cd2e0f1a736eaa349a9df9ab8541c3
NIST National Vulnerability Database
git.kernel.org/stable/c/2e40c69b9c3448b9c6609cd02013da593b2e123b
NIST National Vulnerability Database

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Critical CVE-2026-99999 ipv4: validate checksum_start before completing checksum 1d
Unknown CVE-2026-98432 ipv4: free inet_opt and ireq_opt after an RCU grace period 1d
Unknown CVE-2026-98424 wifi: cfg80211: undo netns switch if renaming the wiphy fails 2d
Unknown CVE-2026-98425 wifi: mac80211: don't warn when an IBSS has no channel to scan 2d
Unknown CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 2d
Unknown CVE-2026-98427 net/sched: codel: bound the dropping loop per dequeue call 2d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CVSS score published by NVD, the CNA, CISA or GitHub so far.
No fixed version, patch or mitigation documented.
No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-97995 is "virtio_console: do not free control-out buffers on remove", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. EPSS 0.18% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.