CVE-2026-97993

A flaw was found in the Linux kernel's vhost-vdpa subsystem. A local attacker can cause a Denial of Service DoS by exploiting a race condition when updating interrupt configurations with an invalid file descriptor. Because the kernel temporarily installs an unvalidated error pointer into the devi...

CVE-2026-97994

A flaw was found in the Linux kernel's vhost-vDPA virtio Data Path Acceleration subsystem. A local user with access to a vhost-vDPA device can configure a queue size that exceeds the device's maximum supported capacity due to insufficient boundary validation. This improper validation can lead to ...

CVE-2026-97992

A flaw was found in the Linux kernel's vhost-vdpa driver. A race condition between device configuration updates and event notifications allows a context structure to be freed while still being accessed by an active callback. A local user with access to the device interface can exploit this...

AZL-104217 CVE-2026-97994 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

CVE-2026-97993

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

DEBIAN-CVE-2026-97993

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

DEBIAN-CVE-2026-97994

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

AZL-104819 CVE-2026-97992 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...

DEBIAN-CVE-2026-97992

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...

AZL-104534 CVE-2026-97993 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

UBUNTU-CVE-2026-97994

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

CVE-2026-97994

The Linux kernel contains a vulnerability in the vhost-vdpa component where vhost_vring_set_num() accepts a queue size that exceeds the device's maximum capacity without proper validation against get_vq_num_max(). A process with access to /dev/vhost-vdpa-* can exploit this to configure a queue la...

CVE-2026-97993

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

CVE-2026-97994

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

EUVD-2026-86647

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

EUVD-2026-86648

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

CVE-2026-97993

A vulnerability exists in the Linux kernel 's vhost-vdpa driver within the vhost_vdpa_set_config_call() function. The issue arises because the code swaps the return value of eventfd_ctx_fdget() into v->config_ctx before checking for errors, briefly holding an ERR_PTR . If a config interrupt oc...

CVE-2026-97994 vhost/vdpa: reject VRING_NUM larger than device max

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

CVE-2026-97993 vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

CVE-2026-97993 vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...