PT-2026-64678 · Linux · Linux
CVE-2026-64457
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
virtio pci: fix vq info pointer lookup via wrong index
Unbinding a virtio balloon device:
echo virtio0 > /sys/bus/virtio/drivers/virtio balloon/unbind
triggers a NULL pointer dereference. The dmesg says:
BUG: kernel NULL pointer dereference, address: 0000000000000008
[...]
RIP: 0010: list del entry valid or report+0x5/0xf0
Call Trace:
vp del vqs+0x121/0x230
remove common+0x135/0x150
virtballoon remove+0xee/0x100
virtio dev remove+0x3b/0x80
device release driver internal+0x187/0x2c0
unbind store+0xb9/0xe0
kernfs fop write iter.llvm.11660790530567441834+0xf6/0x180
vfs write+0x2a9/0x3b0
ksys write+0x5c/0xd0
do syscall 64+0x54/0x230
entry SYSCALL 64 after hwframe+0x29/0x31
[...]
The virtio balloon device registers 5 queues (inflate, deflate, stats,
free page, reporting) but only the first two are unconditional. The
stats, free page and reporting queues are each conditional on their
respective feature bits. When any of these features are absent, the
corresponding vqs info entry has name == NULL, creating holes in the
array.
The root cause is an indexing mismatch introduced when vq info storage
was changed to be passed as an argument. vp find vqs msix() and
vp find vqs intx() store the info pointer at vp dev->vqs[i], where 'i'
is the caller's sparse array index. However, the virtqueue itself gets
vq->index assigned from queue idx, a dense index that skips NULL
entries. When holes exist, 'i' and queue idx diverge. Later,
vp del vqs() looks up info via vp dev->vqs[vq->index] using the dense
index into the sparsely-populated array, and hits NULL.
Fix this by storing info at vp dev->vqs[queue idx] instead of
vp dev->vqs[i], so the store index matches the lookup index
(vq->index). Apply the fix to both the MSIX and INTX paths.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux