Executive brief
A vulnerability in the Linux kernel's virtio_pci driver can cause a system crash (NULL pointer dereference) when unbinding certain virtual devices, such as a virtio balloon device. This component is responsible for managing communication between the operating system and virtualized hardware. An exploit of this flaw would lead to a denial-of-service condition, potentially disrupting operations on virtualized servers or cloud environments.
Technical details
A NULL pointer dereference exists in the virtio_pci driver due to an indexing mismatch between sparse and dense arrays. When a virtio_balloon device (or similar) registers queues conditionally based on feature bits, holes are created in the vqs_info array. The functions vp_find_vqs_msix() and vp_find_vqs_intx() incorrectly used a sparse index to store info pointers, while the virtqueue itself used a dense index. Consequently, during device unbinding, vp_del_vqs() attempts to look up info using the dense index into the sparse array, resulting in a NULL pointer dereference. This can be triggered by a local user with sufficient privileges to unbind drivers via sysfs. The issue has been patched in the stable Linux kernel branches.
Affected products
- Linux Linux Kernel v6.11+
Timeline
- 2026-03-15: other: Patch authored
- 2026-07-18: patched: Patch committed to stable tree
- 2026-07-25: advisory: CVE published