CVE-2026-64457: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64457 Overview

CVE-2026-64457 is a NULL pointer dereference vulnerability in the Linux kernel's virtio_pci driver. The flaw occurs during virtqueue teardown when unbinding a virtio_balloon device with sparsely populated virtqueues. An indexing mismatch between the sparse array index used during allocation and the dense vq->index used during lookup causes vp_del_vqs() to dereference a NULL vqs_info entry. The result is a kernel crash triggered by an unprivileged unbind operation on affected virtio device configurations.

Critical Impact
A local operator with permission to write to /sys/bus/virtio/drivers/*/unbind can trigger a kernel NULL pointer dereference, causing a denial of service on the host or guest.

Affected Products

Linux kernel virtio_pci driver (versions containing the vq info storage refactor)
Guests and hosts using virtio_balloon with optional feature bits disabled
Any virtio device driver relying on vp_find_vqs_msix() or vp_find_vqs_intx() with sparse virtqueue configurations

Discovery Timeline

2026-07-25 - CVE-2026-64457 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64457

Vulnerability Analysis

The virtio_balloon device registers five virtqueues: inflate, deflate, stats, free_page, and reporting. Only the first two are unconditional. The remaining three are gated by their respective feature bits. When a feature is absent, its vqs_info entry has name == NULL, producing holes in the array.

Unbinding the device triggers the code path unbind_store → device_release_driver_internal → virtio_dev_remove → virtballoon_remove → remove_common → vp_del_vqs. Inside vp_del_vqs(), the driver walks each virtqueue and looks up its info using vp_dev->vqs[vq->index]. If any earlier feature-gated queue was absent, the lookup lands on a NULL entry and crashes in __list_del_entry_valid_or_report.

Root Cause

The defect is an indexing mismatch introduced when virtqueue info storage was refactored to be passed as a caller argument. vp_find_vqs_msix() and vp_find_vqs_intx() store the info pointer at vp_dev->vqs[i], where i is the caller's sparse array index that includes NULL slots. However, the virtqueue itself is assigned vq->index = queue_idx, a dense counter that increments only for populated entries. When holes exist, i and queue_idx diverge, so subsequent lookups using vq->index reference the wrong slot [CWE-476].

Attack Vector

The crash is triggered by a write to a sysfs unbind entry such as echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind. Because sysfs unbind is restricted to root by default, exploitation requires local privileged access or a container escape path that exposes the sysfs write. The upstream fix stores the info pointer at vp_dev->vqs[queue_idx] instead of vp_dev->vqs[i], aligning the store index with the lookup index in both the MSIX and INTX code paths. See the Linux kernel commits referenced below for the patch details.

Detection Methods for CVE-2026-64457

Indicators of Compromise

Kernel oops entries in dmesg referencing BUG: kernel NULL pointer dereference, address: 0000000000000008 with a call trace through vp_del_vqs+0x121/0x230
Crashes originating from virtballoon_remove or virtio_dev_remove following an unbind_store operation
Unexpected virtio driver unbind events recorded in audit logs targeting /sys/bus/virtio/drivers/

Detection Strategies

Monitor kernel ring buffer output for NULL pointer dereferences that trace into vp_del_vqs or the virtio balloon remove path
Correlate sysfs writes to /sys/bus/virtio/drivers/*/unbind with subsequent host or guest kernel panics
Enable auditd rules on virtio sysfs paths to capture the process, user, and container context of unbind attempts

Monitoring Recommendations

Ingest kernel logs and audit records into a centralized analytics pipeline for pattern matching across fleet hosts
Alert on repeated virtio driver unbind operations from non-administrative accounts or unexpected container workloads
Track kernel version inventory to identify hosts still running unpatched virtio_pci builds

How to Mitigate CVE-2026-64457

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the commits below and rebuild or update affected kernels
Restrict write access to /sys/bus/virtio/drivers/*/unbind to trusted administrative accounts only
Audit container and virtualization configurations to ensure sysfs is not exposed writable to untrusted workloads

Patch Information

The fix stores the virtqueue info pointer at vp_dev->vqs[queue_idx] to match the lookup index used by vp_del_vqs(). Patches are available in the following upstream commits: Linux Kernel Commit 075bc3c7, Linux Kernel Commit 41e6dc1a, Linux Kernel Commit 64a4c0be, and Linux Kernel Commit f7d380fb.

Workarounds

Avoid unbinding virtio_balloon and similar virtio devices on unpatched kernels
Enforce namespace and capability restrictions that prevent unprivileged containers from writing to virtio sysfs entries
Where feasible, disable optional virtio_balloon features consistently across guests to reduce configurations that produce sparse virtqueue arrays

bash

# Restrict sysfs unbind access to root only (example permission hardening)
chmod 600 /sys/bus/virtio/drivers/virtio_balloon/unbind

# Verify the running kernel version against patched builds
uname -r