UBUNTU-CVE-2026-98264: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: reset device before deleting virtqueues virtsndremove() and virtsndfreeze() delete the virtqueues before resetting the device. delvqs() frees the vring backing, but does not provide a generic device quiesce operation. In particular, modern virtio-pci keeps enabled queues active until the device is reset. Reset the device before deleting the virtqueues so it can no longer access the vring memory when that memory is released. This also covers probe failures after DRIVEROK, which unwind through virtsndremove().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Reset the virtio device before deleting its virtqueues, including in virtsnd_remove() and virtsnd_freeze(), so the device can no longer access vring memory before it is released.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue applies to Ubuntu systems using the listed Linux kernel packages where the ALSA virtio sound driver is in use, including linux, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-riscv, and linux-gkeop. The vulnerable path involves virtio-pci devices with active virtqueues.
When can the unsafe memory access occur?
It can occur during virtio sound device removal or freeze, and during probe-failure cleanup after DRIVER_OK has been set. In these paths, virtqueue backing memory may be released while a modern virtio-pci device can still access enabled queues.
What is the relevant mitigation if an updated kernel cannot be deployed immediately?
The provided information does not identify a configuration workaround. Reducing reliance on the affected ALSA virtio sound device lifecycle paths may limit exposure, but no specific operational mitigation is stated.