From mboxrd@z Thu Jan 1 00:00:00 1970 From: AL-KERNEL To: kernel-cve@kernelcve.org Subject: [CVE-2026-97995][MODERATE REGULAR] virtio_console: do not free control-out buffers on remove [ Upstream Date: Fri, 25 Sep 2026 14:34:18 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-AL-KERNEL-CVE: CVE-2026-97995 X-AL-KERNEL-Priority: MODERATE REGULAR X-AL-KERNEL-Severity: MODERATE REGULAR X-AL-KERNEL-Base-Severity: MODERATE X-AL-KERNEL-KPANIC: NO X-AL-KERNEL-ActionableScore: 0 X-AL-KERNEL-ActionableScore-Lower: unknown X-AL-KERNEL-Commit: 177ee901aa2bab02e7f1f8edbb814fd5e386ed62 List-Id: CVE: CVE-2026-97995 Priority: MODERATE REGULAR AL-KERNEL base severity: MODERATE KPANIC flag: NO Patch: virtio_console: do not free control-out buffers on remove [ Upstream Commit: 177ee901aa2bab02e7f1f8edbb814fd5e386ed62 Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=177ee901aa2bab02e7f1f8edbb814fd5e386ed62 Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97995 Analysis date: Fri, 25 Sep 2026 14:34:18 -0400 ActionableScore: 0 ActionableScore lower bound: unknown Actionable bucket: Ordinary Moderate Manual review required: NO Summary: No one-sentence report phrase was found. ====================================================================== ABOUT THIS REPORT ====================================================================== The original Linux kernel CVE announcement for CVE-2026-97995 is available here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97995 The original announcement does not normally provide a security severity estimate, CVSS assessment, or enough information to determine whether the reported kernel bug represents a practically relevant security issue. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. It combines an autonomous classifier with LLM-assisted technical analysis and a separate ActionableScore mechanism. The purpose of this report is to prioritize Linux kernel CVEs before manual review, identify cases that require prompt investigation, and support automatic closure of issues that are unlikely to have meaningful security impact. Published priority for this report: MODERATE REGULAR Manual review required: NO A detailed explanation of the methodology and priority rules is included at the end of this message. ====================================================================== AL-KERNEL CLASSIFICATION RESULT ====================================================================== CVE-2026-97995 MODERATE https://www.kernelcve.org/list/?q=CVE-2026-97995 CHECK WITH IMPACT FROM ORIG NN LOW Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H';CWE-125;CWE-843;CWE-704;Other CVSS 'AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '4.4';DESCR 'A slab out of bounds access in virtio_console can occur during virtio device removal because the control out virtqueue uses portdev cpkt as its cookie while remove_vqs treats leftover cookies as port_buffer objects. If a control message remains queued on c_ovq during unbind or hot removal, free_buf reads port_buffer fields beyond the ports_device allocation and may crash the kernel. For the CVSS the PR:H because reliable triggering normally requires administrative control over virtio device unbind or hot removal in the guest. The issue is not directly network reachable. Impact is kernel denial of service. No confidentiality or integrity impact is established because the patch demonstrates an invalid out of bounds read but no controlled write information disclosure or use after free primitive.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Ordinary Moderate (with actual score 0) YES WRITE KASAN OOB LOCK VIRT INIT HARDWARE LINUS PACKET DECREASED_TO_MODERATE_REGULAR_FROM_MODERATE7_BASED_ON_GUESSCVSS NO NO checked ====================================================================== ACTIONABLESCORE ANALYSIS ====================================================================== ActionableScore=0 PrimitiveClass=CLASS_C RealUAF=NO HostAdminRequired=YES NamespaceScopedPrivilege=NO ImportantCandidate=NO ManualReview=RECOMMENDED AutoDowngradeAllowed=YES 1. ActionableScore * Raw conservative score: -1 * Conservative score: 0 after normalizing the negative raw score to the minimum score. * Raw paranoid score: 0 * Paranoid score: 0 after normalizing the score. * Final recommended bucket: **Ordinary Moderate**:: 2. Signal breakdown * +1 Weak indirect corruption concern. `remove_vqs()` interprets the `portdev->cpkt` control-message cookie as `struct port_buffer` and `free_buf()` reads fields beyond the actual `ports_device` allocation. KASAN confirms a slab out-of-bounds access. * +0 Conservative kernel-crash signal. The supplied evidence confirms KASAN detection, but does not directly establish a reliable production-kernel panic or a completed invalid free. * +1 Paranoid kernel DoS signal. A stale queued control message reaches teardown cleanup and invalid object interpretation in `free_buf()` can plausibly cause an Oops or crash. This does not change the final score after the privilege penalty. * -2 Host-admin-equivalent privilege. The demonstrated trigger is `unbind_store` followed by `virtcons_remove`. Unbinding the virtio device through the relevant sysfs driver/device-management path requires administrative control in the guest. * No UAF signal. `portdev` remains allocated while `free_buf()` misinterprets an embedded `cpkt` member. The patch does not establish that `ports_device` was freed before use. * No controlled reclaim, controlled replacement, arbitrary write, callback control, disclosure, or privilege-escalation primitive is demonstrated. * No remote-reachability signal. The vulnerable operation is device removal, not normal virtio-console data processing reachable from an external network peer. * No repeated release or refcount mutation signal. The supplied patch establishes an invalid object interpretation and out-of-bounds field read, not two lifetime-affecting operations on a potentially freed reference. * No confidentiality or integrity signal. There is no shown copy-back, disclosure path, attacker-directed write, or modification of security-sensitive state. * No extra Availability point. The potential Oops or crash is the same consequence as the teardown-time invalid access and is not independently counted. 3. Reachability analysis The demonstrated trigger requires a control packet to remain queued on the multiport control-out virtqueue while the virtio-console device is removed. The visible reproducer path is a local sysfs unbind operation through `unbind_store`. For an attacker operating inside the affected guest, the complete trigger normally requires administrative authority to unbind or remove the virtio device. This is host-admin-equivalent within the guest security domain for CVE triage purposes. The supplied evidence does not establish that an ordinary guest user, a container user, or a namespace-scoped capability can perform the complete unbind sequence. Virtio-console operation itself does not require unusual physical hardware, but the triggering teardown action is a device-management operation. A hypervisor administrator may also remove the device from outside the guest, but that actor already controls virtual hardware and this does not establish a useful below-admin attacker path against the guest. The pending-control-message condition is required, but the supplied evidence does not establish a narrow or uncontrollable race. Therefore no separate timing penalty is applied. 4. Primitive and severity interpretation The concrete primitive is an invalid semantic reinterpretation of an embedded `portdev->cpkt` control-message object as `struct port_buffer`. `free_buf()` then accesses `port_buffer` fields such as `sgpages` beyond the actual `ports_device` object boundary. This is not a real use-after-free. The stale-looking cookie remains a valid pointer to an embedded object, but it has the wrong type for the cleanup routine. The demonstrated access occurs in a device teardown and cleanup path. It is therefore closer to a constrained invalid-state and out-of-bounds-read condition than to active-object lifetime corruption. The patch does not establish that `free_buf()` reaches a controlled invalid free, modifies attacker-selected memory, leaks read bytes, or consumes attacker-controlled replacement-object fields. The possibility that subsequent cleanup may produce a crash warrants review of the full `free_buf()` implementation, but does not establish a Class A or meaningful Class B exploitation primitive from the supplied evidence. PrimitiveClass is CLASS_C because the demonstrated behavior is primarily invalid object interpretation, slab out-of-bounds access, and possible kernel DoS. ImportantCandidate is NO because there is no established UAF, repeated lifetime mutation, controlled memory corruption, authorization bypass, or security-boundary violation. AutoDowngradeAllowed is YES because the current evidence supports a constrained privileged teardown-time DoS issue rather than unresolved exploitation leverage. Likely operational severity is Low to ordinary Moderate. It should be patched in normal kernel maintenance, especially on systems allowing delegated device management, but the supplied patch does not justify Important severity. 5. One-sentence report phrase A virtio_console teardown bug treats an embedded control-message cookie as a port_buffer during device unbind, causing a slab out-of-bounds access and possible kernel denial of service for an administrative guest user. 6. Manual review recommendation MANUAL CHECK RECOMMENDED Review the complete `free_buf()` implementation and all fields reached after the invalid cast to confirm whether the bad cookie can progress beyond the observed out-of-bounds read into an invalid free or another write-like cleanup operation. 7. Call-site confidence Call-site confidence: medium ====================================================================== UPSTREAM PATCH SUMMARY ====================================================================== Patch: virtio_console: do not free control-out buffers on remove [ Upstream Commit: 177ee901aa2bab02e7f1f8edbb814fd5e386ed62 Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=177ee901aa2bab02e7f1f8edbb814fd5e386ed62 Changed files: drivers/char/virtio_console.c Diff excerpt: Not included in this email. See the upstream URL for the full patch. Full patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=177ee901aa2bab02e7f1f8edbb814fd5e386ed62 ====================================================================== DETAILED REPORT METHODOLOGY ====================================================================== The original Linux kernel CVE announcement for CVE-2026-97995 can be found here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-97995 The original CVE announcement normally does not include a security-level estimate. In particular, it may not contain a CVSS assessment, an impact level, or enough information to determine whether the reported bug is a practically relevant security issue. One purpose of this parallel CVE list is to provide that missing technical and prioritization information. The original goal of the AL-KERNEL project was to prioritize Linux kernel CVE analysis automatically before manual review. The system can also help identify non-security issues that may be suitable for automatic closure. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. The first analysis stage combines an autonomous classifier with additional LLM-based analysis. The autonomous classifier runs locally on a CPU and is based on a backpropagation neural network. Together, these mechanisms produce a technical vulnerability description, identify likely weakness types, estimate CVSS severity, and provide input for ActionableScore. Two CVSS estimates are retained because incomplete kernel vulnerability information often permits more than one defensible interpretation: Conservative CVSS vector: AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H The Best / paranoid CVSS vector: AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H The Best / paranoid CVSS score: 4.4 The conservative vector represents a lower-impact interpretation. The Best/paranoid vector intentionally represents a plausible upper-bound interpretation and should not automatically be treated as demonstrated real-world impact. CVSS may also need to be adjusted for a particular Linux deployment, because actual reachability, privileges, enabled kernel configuration, hardware, namespaces, exposed device nodes, and other environmental conditions can differ significantly between systems. A separate ActionableScore mechanism evaluates practical remediation urgency. Its analysis may include reachability, attack prerequisites, subsystem exposure, memory-corruption characteristics, denial-of-service reliability, and possible confidentiality, integrity, or privilege-escalation impact. Conservative ActionableScore: unknown Paranoid ActionableScore: 0 The final base severity is taken directly from the second tab-separated field of the AL-KERNEL classification result. ActionableScore does not replace or independently override that final AL-KERNEL decision, and if ActionableScore adjusted impact level of ALKERNEL, then you would see self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7. For an AL-KERNEL result of MODERATE, this report uses the following additional presentation split: ActionableScore below 5 -> MODERATE REGULAR ActionableScore 5 or more -> MODERATE 7.0 The distinction between MODERATE REGULAR and MODERATE 7.0 makes it possible to identify Moderate issues that should receive manual analysis and fixes before lower-priority MODERATE REGULAR issues. In many cases, MODERATE REGULAR fixes may wait for a later rebase or routine update. There is one override in which MODERATE REGULAR becomes MODERATE 7.0 even when the ActionableScore is below 5. When the AL-KERNEL result contains the KPANIC flag, a MODERATE result is always presented as MODERATE 7.0. The KPANIC flag selected with few regexps without usage of AI at all, so it helps to detect cases when Kernel Crash happens and similar (to filter False-Negative results from the LLM usage). KPANIC indicates that a reliable kernel crash, kernel panic, or similarly serious kernel availability impact was identified by the classification workflow. AL-KERNEL base severity for this report: MODERATE KPANIC detected for this report: NO Published priority for this report (same as in Subject): MODERATE REGULAR These results are intended to support engineering triage. They are machine-generated estimates, and cases marked for manual review should be validated by a human security engineer before final disposition. For more info read docs linked from here: https://kernelcve.org/ (and you can submit you own patch there to generate such a report for non-existant CVE-id yet). Note that in many cases this AI tool selects higher severity, than real is (means you can expect Importants instead of Moderate 7.0 or Moderates 7.0 instead of regular Moderates). If you see such cases, please use reply email interface to add additional manual analyses info to this particular CVE. And please, please, let me know when you see Lows instead of Importants or Important instead of Low (because particular for such cases I need to tune this AI tool to make it better for this one and next similar). My contact email for such notifications is alexanjelausa@gmail.com (and both send reply to CVE record itself too and see "reply" button below for howto reply).