CVE-2026-97988

A flaw was found in the Linux kernel's vhost subsystem. When transitioning device address modes or updating feature settings, cached virtual ring pointers and translation metadata are not properly invalidated, leaving stale memory mappings in use. A local attacker with access to the vhost device can exploit this issue during address space transitions, potentially leading to a system crash and a Denial of Service (DoS).

A race in vhost IOTLB transitions can leave cached vring pointers and per VQ IOTLB metadata associated with an old address space while a worker continues descriptor processing. Replacing or disabling the device IOTLB without invalidating these cached references can expose a worker to stale mappings after the old IOTLB table is detached or freed. This creates a plausible stale pointer or use after free condition that may cause a host kernel crash and may also direct vring accesses to unintended memory. For the CVSS the PR:L is selected because triggering requires a local process with access to a vhost device or an existing vhost file descriptor, but this process may be a reduced privilege QEMU or service account rather than a fully privileged administrator. The issue is not directly network reachable and guest traffic alone does not normally control VIRTIO_F_ACCESS_PLATFORM transitions. Impact is at least a local denial of service and may include confidentiality, integrity, or privilege escalation impact if stale IOTLB metadata can be reused as a memory corruption primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.