UBUNTU-CVE-2026-97994: Low severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum() accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum() without comparing it with getvqnummax(). A process with access to /dev/vhost-vdpa- can therefore configure a queue larger than the device advertises. With vdpasim, the worker can walk descriptors beyond the mapped descriptor ring. KASAN reports a 16-byte out-of-bounds read, corresponding to one vringdesc, in the vringh IOTLB path: BUG: KASAN: out-of-bounds in copyfromiter Read of size 16 copyfromiotlb copydesciotlb vringhgetdesciotlb vdpasimnetwork Cache getvqnummax() immediately after reset. Some backends derive it from writable queue-size state, so querying it after SETNUM may return the current size instead of the device capability. Invalidate the cached value before reset so a failed reset leaves SETNUM disabled. For VHOSTSETVRINGNUM, copy the complete vring state once and use the same index and size for validation, vq->num, and setvqnum(). This ensures that validation and use operate on the same copied values.