CVE-2026-64457 - Vulnerability Details

- virtio_pci: fix vq info pointer lookup via wrong index

Description

In the Linux kernel, the following vulnerability has been resolved:

virtio_pci: fix vq info pointer lookup via wrong index

Unbinding a virtio balloon device:

echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind

triggers a NULL pointer dereference. The dmesg says:

BUG: kernel NULL pointer dereference, address: 0000000000000008
[...]
RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0
Call Trace:
<TASK>
vp_del_vqs+0x121/0x230
remove_common+0x135/0x150
virtballoon_remove+0xee/0x100
virtio_dev_remove+0x3b/0x80
device_release_driver_internal+0x187/0x2c0
unbind_store+0xb9/0xe0
kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180
vfs_write+0x2a9/0x3b0
ksys_write+0x5c/0xd0
do_syscall_64+0x54/0x230
entry_SYSCALL_64_after_hwframe+0x29/0x31
[...]
</TASK>

The virtio_balloon device registers 5 queues (inflate, deflate, stats,
free_page, reporting) but only the first two are unconditional. The
stats, free_page and reporting queues are each conditional on their
respective feature bits. When any of these features are absent, the
corresponding vqs_info entry has name == NULL, creating holes in the
array.

The root cause is an indexing mismatch introduced when vq info storage
was changed to be passed as an argument. vp_find_vqs_msix() and
vp_find_vqs_intx() store the info pointer at vp_dev->vqs[i], where 'i'
is the caller's sparse array index. However, the virtqueue itself gets
vq->index assigned from queue_idx, a dense index that skips NULL
entries. When holes exist, 'i' and queue_idx diverge. Later,
vp_del_vqs() looks up info via vp_dev->vqs[vq->index] using the dense
index into the sparsely-populated array, and hits NULL.

Fix this by storing info at vp_dev->vqs[queue_idx] instead of
vp_dev->vqs[i], so the store index matches the lookup index
(vq->index). Apply the fix to both the MSIX and INTX paths.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A NULL pointer dereference occurs in the Linux kernel when a virtio balloon device is unbound through the /sys interface. The flaw stems from an index mismatch between the virtqueue’s dense index and the sparse array used to store vq information, causing the kernel to look up a NULL pointer during cleanup. The resulting BUG triggers a kernel panic, effectively crashing the host. This is a local denial‑of‑service vulnerability that does not provide remote code execution or privilege escalation directly.

Affected Systems

The vulnerability exists in all Linux kernel releases that have not applied the patch identified by commits 075bc3c7, 41e6dc1a, 64a4c0be, and f7d380fb. Systems running any unpatched kernel, regardless of distribution, are potentially affected when a virtio balloon device is present and unbound.

Risk and Exploitability

The EPSS score is < 1%, indicating a very low likelihood of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. An attacker would need local control to invoke the unbind operation, which typically requires root or equivalent privileges. Although remote exploitation is not supported, a local attacker could force a kernel crash, disrupting availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`89a1c435aec269d109ed46ca7bbb10fa8edf7ace`	affected	< 41e6dc1a10036c9f47057033f19af7e52ec464b6
`89a1c435aec269d109ed46ca7bbb10fa8edf7ace`	affected	< 075bc3c779e1ea7294afabdcb7e0a49536959b28
`89a1c435aec269d109ed46ca7bbb10fa8edf7ace`	affected	< 64a4c0befa77bcc01076aec9f93863ffd4ed06b7
`89a1c435aec269d109ed46ca7bbb10fa8edf7ace`	affected	< f7d380fb525c13bdd114369a1979c80c346e6abc

Linux

affected

Version	Status	Constraints
`6.11`	affected	—
`0`	unaffected	< 6.11
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[89a1c435aec269d109ed46ca7bbb10fa8edf7ace,41e6dc1a10036c9f47057033f19af7e52ec464b6)`	affected	code_commit	—
`[89a1c435aec269d109ed46ca7bbb10fa8edf7ace,075bc3c779e1ea7294afabdcb7e0a49536959b28)`	affected	code_commit	—
`[89a1c435aec269d109ed46ca7bbb10fa8edf7ace,64a4c0befa77bcc01076aec9f93863ffd4ed06b7)`	affected	code_commit	—
`[89a1c435aec269d109ed46ca7bbb10fa8edf7ace,f7d380fb525c13bdd114369a1979c80c346e6abc)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.11`	affected	generic	—
`[0,6.11)`	unaffected	generic	—
`[0,6.13.0)`	unaffected	generic	—
`[0,6.19.0)`	unaffected	generic	—
`[0,7.2.0)`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that includes the commit fixing the virtqueue info lookup bug (e.g kernel containing commit 075bc3c779e1ea7294afabdcb7e0a49536959b28 or newer).
Disable or remove virtio balloon devices from the virtual machine configuration if unbinding is not required, or use virtualization settings that prevent automatic unbinding.
Restrict write access to /sys/bus/virtio/drivers/virtio_balloon/unbind so that only trusted administrative users can trigger the operation.

Generated by OpenCVE AI on August 4, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00175.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/075bc3c779e1ea7294afabdcb7e0a49536959b28
https://git.kernel.org/stable/c/41e6dc1a10036c9f47057033f19af7e52ec464b6
https://git.kernel.org/stable/c/64a4c0befa77bcc01076aec9f93863ffd4ed06b7
https://git.kernel.org/stable/c/f7d380fb525c13bdd114369a1979c80c346e6abc
https://lore.kernel.org/linux-cve-announce/2026072542-CVE-2026-64457-9f4a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64457
https://www.cve.org/CVERecord?id=CVE-2026-64457

History

Mon, 03 Aug 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Mon, 03 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072542-CVE-2026-64457-9f4a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64457 https://www.cve.org/CVERecord?id=CVE-2026-64457
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Thu, 30 Jul 2026 03:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-476

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind triggers a NULL pointer dereference. The dmesg says: BUG: kernel NULL pointer dereference, address: 0000000000000008 [...] RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0 Call Trace: <TASK> vp_del_vqs+0x121/0x230 remove_common+0x135/0x150 virtballoon_remove+0xee/0x100 virtio_dev_remove+0x3b/0x80 device_release_driver_internal+0x187/0x2c0 unbind_store+0xb9/0xe0 kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180 vfs_write+0x2a9/0x3b0 ksys_write+0x5c/0xd0 do_syscall_64+0x54/0x230 entry_SYSCALL_64_after_hwframe+0x29/0x31 [...] </TASK> The virtio_balloon device registers 5 queues (inflate, deflate, stats, free_page, reporting) but only the first two are unconditional. The stats, free_page and reporting queues are each conditional on their respective feature bits. When any of these features are absent, the corresponding vqs_info entry has name == NULL, creating holes in the array. The root cause is an indexing mismatch introduced when vq info storage was changed to be passed as an argument. vp_find_vqs_msix() and vp_find_vqs_intx() store the info pointer at vp_dev->vqs[i], where 'i' is the caller's sparse array index. However, the virtqueue itself gets vq->index assigned from queue_idx, a dense index that skips NULL entries. When holes exist, 'i' and queue_idx diverge. Later, vp_del_vqs() looks up info via vp_dev->vqs[vq->index] using the dense index into the sparsely-populated array, and hits NULL. Fix this by storing info at vp_dev->vqs[queue_idx] instead of vp_dev->vqs[i], so the store index matches the lookup index (vq->index). Apply the fix to both the MSIX and INTX paths.
Title		virtio_pci: fix vq info pointer lookup via wrong index
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/075bc3c779e1ea7294afabdcb7e0a49536959b28 https://git.kernel.org/stable/c/41e6dc1a10036c9f47057033f19af7e52ec464b6 https://git.kernel.org/stable/c/64a4c0befa77bcc01076aec9f93863ffd4ed06b7 https://git.kernel.org/stable/c/f7d380fb525c13bdd114369a1979c80c346e6abc

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:51:25.364Z

Updated: 2026-07-25T08:51:25.364Z

Reserved: 2026-07-19T15:36:31.789Z

Link: CVE-2026-64457

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-25T10:17:30.830

Modified: 2026-07-25T10:17:30.830

Link: CVE-2026-64457

Redhat

Severity : Low

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64457 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T14:30:10Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object