CVE-2026-74311: virtio: rtc: tear down old virtqueues before restore
In the Linux kernel, the following vulnerability has been resolved:
virtio: rtc: tear down old virtqueues before restore
virtiodevicerestore() resets the device and restores the negotiated features before calling ->restore(). viortcfreeze() intentionally leaves the existing virtqueues in place so the alarm queue can still wake the system, but viortcrestore() immediately calls viortcinitvqs() without first deleting those old queues.
If virtqueue reinitialization fails on virtio-pci, the transport error path can run vpdelvqs() against a newly allocated vpdev->vqs array while vdev->vqs still contains the old virtqueues. vpdelvqs() then looks up queue state through the new array and can dereference a NULL info pointer in vpdelvq(), crashing the guest kernel during restore.
This can also happen during a non-faulty reinitialization, when one of the vpfindvqsmsix() attempts is unsuccessful before a later attempt would succeed.
Delete the stale virtqueues before rebuilding them. If restore fails before virtiodeviceready(), reuse the remove path to stop the device. Once the device is ready, return errors directly instead of deleting the virtqueues again.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Before rebuilding/reinitializing virtqueues on virtio (e.g., virtio-pci during virtio_device_restore/restore), tear down/delete the stale virtqueues and reuse the device-stop/remove path (vp_del_vqs() / remove path before virtio_device_ready()) so the restore sequence does not crash the guest kernel due to NULL dereference or stale queue state.
Linux kernel virtio (virtio-pci / virtio rtc) virtio: rtc - virtqueues lifecycle during restore = tear down old virtqueues before calling virtio_device_restore/restore path