UBUNTU-CVE-2026-74311: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: tear down old virtqueues before restore virtiodevicerestore() resets the device and restores the negotiated features before calling ->restore(). viortcfreeze() intentionally leaves the existing virtqueues in place so the alarm queue can still wake the system, but viortcrestore() immediately calls viortcinitvqs() without first deleting those old queues. If virtqueue reinitialization fails on virtio-pci, the transport error path can run vpdelvqs() against a newly allocated vpdev->vqs array while vdev->vqs still contains the old virtqueues. vpdelvqs() then looks up queue state through the new array and can dereference a NULL info pointer in vpdelvq(), crashing the guest kernel during restore. This can also happen during a non-faulty reinitialization, when one of the vpfindvqsmsix() attempts is unsuccessful before a later attempt would succeed. Delete the stale virtqueues before rebuilding them. If restore fails before virtiodeviceready(), reuse the remove path to stop the device. Once the device is ready, return errors directly instead of deleting the virtqueues again.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
Tear down stale virtqueues before rebuilding or reinitializing them; if restore fails before virtio_device_ready(), reuse the device remove path to stop the device, and once the device is ready return errors directly without deleting the virtqueues again.
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
The failure occurs in a guest kernel using the virtio RTC driver during device restore, specifically on the virtio-pci transport. The affected Ubuntu kernel package families listed are linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0.
What level of access does an attacker need?
The supplied CVSS vector indicates local access with low privileges is required. It does not require user interaction, and successful exploitation can affect confidentiality, integrity, and availability.
How might an affected system present this problem?
An affected guest can crash during virtio RTC restore if virtqueue reinitialization fails, including when an earlier MSI-X queue setup attempt fails before a later attempt could succeed. The crash results from the virtio-pci cleanup path dereferencing a NULL queue-state pointer in vp_del_vq().