CVE-2026-64457

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> virtio_pci: fix vq info pointer lookup via wrong index<br /> <br /> Unbinding a virtio balloon device:<br /> <br /> echo virtio0 &gt; /sys/bus/virtio/drivers/virtio_balloon/unbind<br /> <br /> triggers a NULL pointer dereference. The dmesg says:<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000008<br /> [...]<br /> RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0<br /> Call Trace:<br /> <br /> vp_del_vqs+0x121/0x230<br /> remove_common+0x135/0x150<br /> virtballoon_remove+0xee/0x100<br /> virtio_dev_remove+0x3b/0x80<br /> device_release_driver_internal+0x187/0x2c0<br /> unbind_store+0xb9/0xe0<br /> kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180<br /> vfs_write+0x2a9/0x3b0<br /> ksys_write+0x5c/0xd0<br /> do_syscall_64+0x54/0x230<br /> entry_SYSCALL_64_after_hwframe+0x29/0x31<br /> [...]<br /> <br /> <br /> The virtio_balloon device registers 5 queues (inflate, deflate, stats,<br /> free_page, reporting) but only the first two are unconditional. The<br /> stats, free_page and reporting queues are each conditional on their<br /> respective feature bits. When any of these features are absent, the<br /> corresponding vqs_info entry has name == NULL, creating holes in the<br /> array.<br /> <br /> The root cause is an indexing mismatch introduced when vq info storage<br /> was changed to be passed as an argument. vp_find_vqs_msix() and<br /> vp_find_vqs_intx() store the info pointer at vp_dev-&gt;vqs[i], where &amp;#39;i&amp;#39;<br /> is the caller&amp;#39;s sparse array index. However, the virtqueue itself gets<br /> vq-&gt;index assigned from queue_idx, a dense index that skips NULL<br /> entries. When holes exist, &amp;#39;i&amp;#39; and queue_idx diverge. Later,<br /> vp_del_vqs() looks up info via vp_dev-&gt;vqs[vq-&gt;index] using the dense<br /> index into the sparsely-populated array, and hits NULL.<br /> <br /> Fix this by storing info at vp_dev-&gt;vqs[queue_idx] instead of<br /> vp_dev-&gt;vqs[i], so the store index matches the lookup index<br /> (vq-&gt;index). Apply the fix to both the MSIX and INTX paths.