CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index
In the Linux kernel, the following vulnerability has been resolved:
virtiopci: fix vq info pointer lookup via wrong index
Unbinding a virtio balloon device:
echo virtio0 > /sys/bus/virtio/drivers/virtioballoon/unbind
triggers a NULL pointer dereference. The dmesg says:
BUG: kernel NULL pointer dereference, address: 0000000000000008 [...] RIP: 0010:listdelentryvalidorreport+0x5/0xf0 Call Trace: <TASK> vpdelvqs+0x121/0x230 removecommon+0x135/0x150 virtballoonremove+0xee/0x100 virtiodevremove+0x3b/0x80 devicereleasedriverinternal+0x187/0x2c0 unbindstore+0xb9/0xe0 kernfsfopwriteiter.llvm.11660790530567441834+0xf6/0x180 vfswrite+0x2a9/0x3b0 ksyswrite+0x5c/0xd0 dosyscall64+0x54/0x230 entrySYSCALL64afterhwframe+0x29/0x31 [...] </TASK>
The virtioballoon device registers 5 queues (inflate, deflate, stats, freepage, reporting) but only the first two are unconditional. The stats, freepage and reporting queues are each conditional on their respective feature bits. When any of these features are absent, the corresponding vqsinfo entry has name == NULL, creating holes in the array.
The root cause is an indexing mismatch introduced when vq info storage was changed to be passed as an argument. vpfindvqsmsix() and vpfindvqsintx() store the info pointer at vpdev->vqs[i], where 'i' is the caller's sparse array index. However, the virtqueue itself gets vq->index assigned from queueidx, a dense index that skips NULL entries. When holes exist, 'i' and queueidx diverge. Later, vpdelvqs() looks up info via vpdev->vqs[vq->index] using the dense index into the sparsely-populated array, and hits NULL.
Fix this by storing info at vpdev->vqs[queueidx] instead of vpdev->vqs[i], so the store index matches the lookup index (vq->index). Apply the fix to both the MSIX and INTX paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the kernel NULL pointer dereference by updating both MSIX and INTX queue setup/teardown paths so that the virtqueue info pointer is stored at vp_dev->vqs[queue_idx] (rather than using a sparse/different index like 'i'), and that vp_del_vqs() looks it up using the same index that was used when storing (vp_dev->vqs[vq->index]). Apply the fix to both vq->index (MSIX) and vq->index assignment from queue_idx (INTX) to eliminate the dense/sparse indexing mismatch where holes cause name == NULL.
virtio_balloon (vp_dev vqs info storage) vq info storage index = Store per-queue info at vp_dev->vqs[queue_idx] and ensure lookup uses the same dense index (vp_dev->vqs[vq->index])
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64457?
CVE-2026-64457 has a risk score of 27, indicating a critical vulnerability.
How do I fix CVE-2026-64457?
To fix CVE-2026-64457, ensure you update the Linux kernel to the latest stable version that addresses this vulnerability.
What does CVE-2026-64457 affect?
CVE-2026-64457 specifically affects the virtio balloon device in the Linux kernel.
What kind of vulnerability is CVE-2026-64457?
CVE-2026-64457 is classified as a Null Pointer Dereference vulnerability.
What happens when CVE-2026-64457 is exploited?
Exploitation of CVE-2026-64457 can lead to a NULL pointer dereference, potentially causing a system crash.