Vulnerability in Linux

[ Description ]Official description

In the Linux kernel, the following vulnerability has been resolved: virtio_console: do not free control-out buffers on remove __send_control_msg() publishes &portdev->cpkt as the control-out virtqueue cookie. remove_vqs() walks every virtqueue and passes leftover cookies to free_buf(), which treats them as struct port_buffer and reads sgpages. If a control message is still on c_ovq when the device is unbound, free_buf() reads past the ports_device object. KASAN reported slab-out-of-bounds in free_buf(): free_buf remove_vqs virtcons_remove unbind_store The object was the ports_device allocated in virtcons_probe(). Drain c_ovq without freeing. The packet lives in portdev and is released with it.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR9 Oct 2026CERTFR-2026-AVI-1289

  Multiple vulnerabilities in the Debian LTS Linux kernel Translated from French

  Multiple vulnerabilities have been discovered in the Debian LTS Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and denial of service.

  CVE-2025-38237CVE-2025-39833CVE-2025-39925+1311 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1253

  Multiple vulnerabilities in the Debian Linux kernel Translated from French

  Multiple vulnerabilities have been discovered in the Debian Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and denial of service.

  CVE-2025-38237CVE-2025-39833CVE-2025-39925+1310 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3579

  Linux Kernel: Multiple vulnerabilities Translated from German

  CVE-2026-97615CVE-2026-97978CVE-2026-98127+590 more CVEs

[ References ]References

• git.kernel.org/stable/c/177ee901aa2bab02e7f1f8edbb814fd5e386ed62
• git.kernel.org/stable/c/2e40c69b9c3448b9c6609cd02013da593b2e123b
• git.kernel.org/stable/c/894f98e73983f37354214a89a3a7fd35bf9e3072
• git.kernel.org/stable/c/8f6cfc3eca79b8e108d0823756101e2f4f9d811f
• git.kernel.org/stable/c/a80c33488e0bbe642ed803b13a4ac8078a70b507
• git.kernel.org/stable/c/b1f39c2a676698cc64c8e105e08b25111a112ec6
• git.kernel.org/stable/c/e03522a990cd2e0f1a736eaa349a9df9ab8541c3
• git.kernel.org/stable/c/f620c40ea6862feed84deb105568b21ec53a7830