CVE-2026-23143: virtio_net: Fix misalignment bug in struct virtnet_info

In the Linux kernel, the following vulnerability has been resolved:

virtionet: Fix misalignment bug in struct virtnetinfo

Use the new TRAILINGOVERLAP() helper to fix a misalignment bug along with the following warning:

drivers/net/virtionet.c:429:46: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

This helper creates a union between a flexible-array member (FAM) and a set of members that would otherwise follow it (in this case u8 rsshashkeydata[VIRTIONETRSSMAXKEYSIZE];). This overlays the trailing members (rsshashkeydata) onto the FAM (hashkeydata) while keeping the FAM and the start of MEMBERS aligned. The staticassert() ensures this alignment remains.

Notice that due to tail padding in flexible struct virtionetrssconfigtrailer, rsstrailer.hashkeydata (at offset 83 in struct virtnetinfo) and rsshashkeydata (at offset 84 in struct virtnetinfo) are misaligned by one byte. See below:

struct virtionetrssconfigtrailer { le16 maxtxvq; / 0 2 / u8 hashkeylength; / 2 1 / u8 hashkeydata[]; / 3 0 /

/ size: 4, cachelines: 1, members: 3 / / padding: 1 / / last cacheline: 4 bytes / };

struct virtnetinfo { ... struct virtionetrssconfigtrailer rsstrailer; / 80 4 /

/ XXX last struct has 1 byte of padding /

u8 rsshashkeydata[40]; / 84 40 / ... / size: 832, cachelines: 13, members: 48 / / sum members: 801, holes: 8, sum holes: 31 / / paddings: 2, sum paddings: 5 / };

After changes, those members are correctly aligned at offset 795:

struct virtnetinfo { ... union { struct virtionetrssconfigtrailer rsstrailer; / 792 4 / struct { unsigned char offsettohashkeydata[3]; / 792 3 / u8 rsshashkeydata[40]; / 795 40 / }; / 792 43 / }; / 792 44 / ... / size: 840, cachelines: 14, members: 47 / / sum members: 801, holes: 8, sum holes: 35 / / padding: 4 / / paddings: 1, sum paddings: 4 / / last cacheline: 8 bytes / };

As a result, the RSS key passed to the device is shifted by 1 byte: the last byte is cut off, and instead a (possibly uninitialized) byte is added at the beginning.

As a last note struct virtionetrssconfighdr rsshdr; is also moved to the end, since it seems those three members should stick around together. :)