PT-2026-20455 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-04-20 · CVE-2026-23229

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel's virtio crypto component related to spinlock protection when handling virtqueue notifications. Specifically, when a virtual machine boots with a single virtio-crypto PCI device and a builtin backend, running the openssl speed command with multiple processes can cause processes to hang. This occurs because the data virtqueue lacks proper protection during virtio done notification handling. The issue manifests as an error message: 'virtio crypto virtio0: dataq.0:id 3 is not a head!'. Adding spinlock protection within the virtcrypto done task() function resolves the problem, allowing the openssl benchmark to function correctly with multiple processes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-23229

ECHO-D387-F0AE-30E7

OESA-2026-1642

OESA-2026-1643

OESA-2026-1644

OPENSUSE-SU-2026:10387-1

OPENSUSE-SU-2026:20416-1

SUSE-SU-2026:0962-1

SUSE-SU-2026:1081-1

SUSE-SU-2026:20667-1

SUSE-SU-2026:20720-1

SUSE-SU-2026:20838-1

SUSE-SU-2026:20845-1

SUSE-SU-2026:20876-1

SUSE-SU-2026:20931-1

SUSE-SU-2026:21284-1

Affected Products

Linux Kernel

References · 1620

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23229.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-57979 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-71195 · Security Note
• https://git.kernel.org/stable/c/c9e594194795c86ca753ad6ed64c2762e9309d0d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23113 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23229 · Vendor Advisory
• https://git.kernel.org/stable/c/49c57c6c108931a914ed94e3c0ddb974008260a3 · Patch
• https://git.kernel.org/stable/c/e69a7b0a71b6561b3b6459f1fded8d589f2e8ac2 · Patch
• https://git.kernel.org/stable/c/8ee8ccfd60bf17cbdab91069d324b5302f4f3a30 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23209 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23128 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1643 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23229 · Vendor Advisory
• https://git.kernel.org/stable/c/552475d0b6cece73a52c0fa5faa0ce45e99df74b · Patch
• https://cve.org/CVERecord?id=CVE-2026-23229 · Security Note