CVE-2026-97995

A flaw was found in the virtio_console driver in the Linux kernel. When unbinding or removing a virtio console device while control messages remain queued, the driver misidentifies internal control buffers and attempts to release them as standard data buffers. This issue results in an out-of-bounds memory read, allowing a local privileged user to cause a system crash leading to a Denial of Service (DoS) or potentially expose sensitive kernel memory.

A moderate-impact flaw was found in the Linux kernel virtio_console driver. When a virtio console device is unbound or removed while a control message is still queued on the control-out virtqueue, remove_vqs() passes the leftover cookie (which points into the ports_device structure, &portdev->cpkt) to free_buf(), which misinterprets it as a struct port_buffer and reads past the end of the ports_device allocation, resulting in a slab out-of-bounds read (reported by KASAN). Exploiting this requires local access with administrative privileges (for example, unbinding the device via sysfs) and a control message in flight on the control-out queue at the moment of removal, so the practical attack surface is narrow. The primary consequence is a kernel crash and denial of service; although the CVE description notes potential exposure of sensitive kernel memory, the Red Hat assessment (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) rates confidentiality as not impacted because the out-of-bounds read occurs internally during device teardown. Red Hat Enterprise Linux 7 Extended Lifecycle Support streams are not affected because the vulnerable code is not present in those kernels. The affected Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and OpenShift (RHEL CoreOS) kernel streams are currently marked for deferred fixes, given that triggering the flaw requires privileged local access and a race during device teardown; the residual risk is that such a privileged local user could crash the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.