UBUNTU-CVE-2026-97995: Medium severity ubuntu/linux-aws vulnerability

In the Linux kernel, the following vulnerability has been resolved: virtioconsole: do not free control-out buffers on remove sendcontrolmsg() publishes &portdev->cpkt as the control-out virtqueue cookie. removevqs() walks every virtqueue and passes leftover cookies to freebuf(), which treats them as struct portbuffer and reads sgpages. If a control message is still on covq when the device is unbound, freebuf() reads past the portsdevice object. KASAN reported slab-out-of-bounds in freebuf(): freebuf removevqs virtconsremove unbindstore The object was the portsdevice allocated in virtconsprobe(). Drain covq without freeing. The packet lives in portdev and is released with it.