CVE-2026-97997

A flaw was found in the Linux kernel's virtio subsystem. When an operation to add descriptors to a packed virtual queue fails under memory pressure, the driver fails to reset the status flags on partially written descriptors. A local user capable of generating large input/output (I/O) operations under memory constraints can cause the device to process stale queue entries, leading to queue blockage and a Denial of Service (DoS).

A low security impact flaw was found in the Linux kernel's virtio_ring handling of packed virtqueues. It affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9 and 10, the kernels shipped with Red Hat Enterprise Linux CoreOS 8 and 9 as used by OpenShift Container Platform 4, and Red Hat In-Vehicle OS 2. When adding a descriptor chain to a packed virtqueue fails partway, typically because a scatter-gather mapping fails under memory pressure in swiotlb configurations, the error path unmaps the mapped segments but leaves the AVAIL and USED status flags set on the descriptors already written. A local user with privileges to generate large I/O operations could, under these specific preconditions, cause a subsequent shorter request that reuses the same ring position to make the device consume stale descriptor entries, blocking the virtqueue and causing a denial of service limited to I/O on that device within the guest. Red Hat rates the security impact of this flaw as Low even though the CVSS:3.1 base score of 5.5 (Moderate) reflects the theoretical worst case, because exploitation requires the unlikely combination of packed virtqueues, swiotlb bounce buffering under memory pressure, and a subsequent shorter request at the same head, and the consequence is limited to availability of a single virtio device. Red Hat Enterprise Linux 7 is not affected because the packed virtqueue support that introduced this flaw is not present in that release. Fixes for the affected streams are currently deferred to a future update; the residual risk while the fix is deferred is a local denial of service against an affected virtio device, with no impact on confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.