CVE-2026-97989: vduse: validate virtqueue alignment
In the Linux kernel, the following vulnerability has been resolved:
vduse: validate virtqueue alignment
vdusevalidateconfig() only checks the upper bound of vqalign. Invalid values can therefore reach vringcreatevirtqueuemap(). The split-ring helpers use align - 1 as a bit mask, so the alignment must be a non-zero power of two. A zero value makes vringsize() drop the descriptor and available-ring part and vringinit() leave the used ring pointer NULL.
The VIRTIO spec requires the used ring to start at an address aligned to at least 4 bytes. Reject values below VRINGUSEDALIGNSIZE as well as non-power-of-two values before they reach the virtio ring helpers.
Opening a virtio-net device created with vqalign=0 triggered:
BUG: KASAN: null-ptr-deref in virtqueuekickpreparesplit+0xe3/0x100 Read of size 2 at addr 0000000000000000 by task systemd-network/1062
Call Trace (relevant frames): dumpstacklvl printreport kasanreport asanload2 virtqueuekickpreparesplit+0xe3/0x100 virtqueuekickprepare+0x40/0x60 tryfillrecv+0x857/0x1250 virtnetopen+0x189/0x460 devopen+0x225/0x390 devchangeflags+0x368/0x3b0 netifchangeflags+0x56/0xc0 dosetlink.isra.0+0x68c/0x1e30
Validate the value before it reaches the virtio ring helpers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure vq_align to a non-zero power-of-two value no smaller than VRING_USED_ALIGN_SIZE; reject zero, values below 4 bytes, and non-power-of-two values before they reach the virtio ring helpers.
vduse/virtio-net vq_align = a non-zero power of two at least VRING_USED_ALIGN_SIZE (4 bytes)
Event History
Frequently Asked Questions
What configuration values trigger the flaw?
An invalid virtqueue alignment can trigger it, specifically vq_align set to zero, below VRING_USED_ALIGN_SIZE, or to a value that is not a power of two. The split-ring helpers require a non-zero power-of-two alignment, and the used ring must be aligned to at least 4 bytes.
What is the practical impact of setting vq_align to zero?
With vq_align=0, vring_size() omits the descriptor and available-ring portion, while vring_init() leaves the used-ring pointer NULL. Opening a virtio-net device created with that value can cause a KASAN-reported NULL-pointer dereference in virtqueue_kick_prepare_split.
When does the observed failure occur?
The reported crash occurred when a virtio-net device configured with vq_align=0 was opened. The relevant path includes virtnet_open and receive-buffer processing before the NULL pointer is read.
What validation is added by the fix?
The fix rejects vq_align values below VRING_USED_ALIGN_SIZE and values that are not powers of two in vduse_validate_config(), before they reach the virtio ring helper functions.