Executive brief
The Linux kernel's virtio_balloon driver (used in virtualized environments to manage guest memory allocation) could trigger a fatal kernel panic during system reboot or kexec operations when the panic_on_warn flag is enabled. The bug occurs because asynchronous work was still running when the device was shut down, causing warnings and potential hangs that could prevent a machine from reaching the new kernel during upgrades.
Technical details
This is a race condition in the virtio_balloon driver's shutdown path. When commit 8bd2fa086a04 added a generic virtio bus .shutdown handler that breaks and resets devices during reboot/kexec, virtio_balloon had no custom shutdown handler, so the generic path ran while balloon work was still queued. Once the device was broken, virtqueue_add_inbuf() would return -EIO, triggering WARN_ON_ONCE() and causing a kernel panic on systems with panic_on_warn enabled. Additionally, inflate/deflate and OOM code paths would hang indefinitely on the broken queue. The fix adds a .shutdown handler that quiesces the balloon device via virtballoon_quiesce() before invoking the generic virtio_device_shutdown(), ensuring asynchronous work completes or cancels before the device is broken.
Affected products
- Linux Linux kernel multiple stable versions (3.2 through 7.2+)
Timeline
- 2026-09-17: disclosed
- 2026-08-19: patched: Upstream commit 7e17eef04600c399c7e0f5ce765da5cf9d40d8e1