{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-74311", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.883Z", "datePublished": "2026-08-15T05:58:10.711Z", "dateUpdated": "2026-08-17T05:45:43.827Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:43.827Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: rtc: tear down old virtqueues before restore\n\nvirtio_device_restore() resets the device and restores the negotiated\nfeatures before calling ->restore(). viortc_freeze() intentionally\nleaves the existing virtqueues in place so the alarm queue can still\nwake the system, but viortc_restore() immediately calls\nviortc_init_vqs() without first deleting those old queues.\n\nIf virtqueue reinitialization fails on virtio-pci, the transport error\npath can run vp_del_vqs() against a newly allocated vp_dev->vqs array\nwhile vdev->vqs still contains the old virtqueues. vp_del_vqs() then\nlooks up queue state through the new array and can dereference a NULL\ninfo pointer in vp_del_vq(), crashing the guest kernel during restore.\n\nThis can also happen during a non-faulty reinitialization, when one of\nthe vp_find_vqs_msix() attempts is unsuccessful before a later attempt\nwould succeed.\n\nDelete the stale virtqueues before rebuilding them. If restore fails\nbefore virtio_device_ready(), reuse the remove path to stop the device.\nOnce the device is ready, return errors directly instead of deleting the\nvirtqueues again." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached only through the kernel system sleep PM path (suspend/hibernate freeze/thaw/restore) that calls virtio_pci_restore() -> virtio_device_restore() -> viortc_restore(); it is not reachable from network packets, remote protocols, or physical device attachment.\nAC:L - Any actor who can drive a suspend/hibernate cycle on a guest with virtio-pci virtio_rtc can trigger restore; virtio-pci routinely retries MSI-X allocation policies and the commit notes the crash occurs on a failed attempt before a later one would succeed, so success does not depend on uncontrollable timing or layout.\nPR:L - Triggering suspend/hibernate/thaw is available to unprivileged local users on typical desktop, mobile, and embedded systems via logind/power interfaces or RTC alarm wake without requiring real root in the init namespace or capabilities unavailable in user namespaces.\nUI:N - Exploitation requires only initiating or allowing system suspend/hibernate and resume; no separate victim user action such as opening a file, mounting a filesystem, or clicking a prompt is needed beyond the attacker's own power-management trigger.\nS:U - The fault corrupts or crashes the same guest kernel that owns the virtio_rtc driver during PM restore; it does not cross a VM/host, IOMMU, or sandbox security boundary to impact a different authority.\nC:H - Failed virtqueue reinit leaves stale queues on vdev->vqs while vp_del_vqs() indexes a new vp_dev->vqs array, causing NULL or mismatched virtio_pci_vq_info teardown that can corrupt heap metadata and disclose kernel memory beyond a simple bounded fault.\nI:H - The same mismatched vp_del_vq()/vp_del_vqs() teardown can corrupt kernel linked lists and free or misuse queue metadata, providing a plausible path to further memory corruption and control-flow hijack rather than only an immediate crash.\nA:H - The documented failure mode is a NULL pointer dereference in vp_del_vq() during restore that oopses or panics the guest kernel, and a failed restore can also leave the system unable to resume cleanly from suspend/hibernate." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/virtio/virtio_rtc_driver.c" ], "versions": [ { "version": "0623c759276885c3ae88197ba6fb5c9c6ba8612f", "lessThan": "79366023aa891ca31376021a7bccff6384ca1ff1", "status": "affected", "versionType": "git" }, { "version": "0623c759276885c3ae88197ba6fb5c9c6ba8612f", "lessThan": "aebebd1e9d70b650fc9e877082e0134edcf511da", "status": "affected", "versionType": "git" }, { "version": "0623c759276885c3ae88197ba6fb5c9c6ba8612f", "lessThan": "548d2208455f14e6121404c6e30e997bfe0cd264", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/virtio/virtio_rtc_driver.c" ], "versions": [ { "version": "6.16", "status": "affected" }, { "version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.40" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/79366023aa891ca31376021a7bccff6384ca1ff1" }, { "url": "https://git.kernel.org/stable/c/aebebd1e9d70b650fc9e877082e0134edcf511da" }, { "url": "https://git.kernel.org/stable/c/548d2208455f14e6121404c6e30e997bfe0cd264" } ], "title": "virtio: rtc: tear down old virtqueues before restore", "x_generator": { "engine": "bippy-1.2.0" } } } }