Look up another CVE · open CVE-2026-74311 in the interactive tracker
CVE-2026-74311
virtio: rtc: tear down old virtqueues before restore
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/virtio. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-74311 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
virtio_device_restore() resets the device and restores the negotiated features before calling ->restore(). viortc_freeze() intentionally leaves the existing virtqueues in place so the alarm queue can still wake the system, but viortc_restore() immediately calls viortc_init_vqs() without first deleting those old queues. If virtqueue reinitialization fails on virtio-pci, the transport error path can run vp_del_vqs() against a newly allocated vp_dev->vqs array while vdev->vqs still contains the old virtqueues. vp_del_vqs() then looks up queue state through the new array and can dereference a NULL info pointer in vp_del_vq(), crashing the guest kernel during restore. This can also happen during a non-faulty reinitialization, when one of the vp_find_vqs_msix() attempts is unsuccessful before a later attempt would succeed. Delete the stale virtqueues before rebuilding them. If restore fails before virtio_device_ready(), reuse the remove path to stop the device. Once the device is ready, return errors directly instead of deleting the virtqueues again.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/virtio/virtio_rtc_driver.c
- What this is
- VIRTIO RTC DRIVERMAINTAINERS section matched on drivers/virtio/virtio_rtc_* · virtualization@lists.linux.dev · Maintained
Check it on the machine
grep -w CONFIG_VIRTIO_RTC /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code in 2 releases. The build rule could not be established for 2 releases, so nothing is claimed about those.
- bookworm, trixie?
- forky, sidn
- ?
- not established - no Makefile entry for the affected file
- n
- not enabled on any flavour - this release does not build the code
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_VIRTIO_RTC
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 6.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/virtio
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.16 | 6.18.40 | 79366023aa89 |
| 6.16 | 7.1.5 | aebebd1e9d70 |
| 6.16 | 7.2 | 548d2208455f |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached only through the kernel system sleep PM path (suspend/hibernate freeze/thaw/restore) that calls virtio_pci_restore() -> virtio_device_restore() -> viortc_restore(); it is not reachable from network packets, remote protocols, or physical device attachment.
- AC:LAttack complexity, low
- Any actor who can drive a suspend/hibernate cycle on a guest with virtio-pci virtio_rtc can trigger restore; virtio-pci routinely retries MSI-X allocation policies and the commit notes the crash occurs on a failed attempt before a later one would succeed, so success does not depend on uncontrollable timing or layout.
- PR:LPrivileges required, low
- Triggering suspend/hibernate/thaw is available to unprivileged local users on typical desktop, mobile, and embedded systems via logind/power interfaces or RTC alarm wake without requiring real root in the init namespace or capabilities unavailable in user namespaces.
- UI:NUser interaction, none
- Exploitation requires only initiating or allowing system suspend/hibernate and resume; no separate victim user action such as opening a file, mounting a filesystem, or clicking a prompt is needed beyond the attacker's own power-management trigger.
- S:UScope, unchanged
- The fault corrupts or crashes the same guest kernel that owns the virtio_rtc driver during PM restore; it does not cross a VM/host, IOMMU, or sandbox security boundary to impact a different authority.
- C:HConfidentiality impact, high
- Failed virtqueue reinit leaves stale queues on vdev->vqs while vp_del_vqs() indexes a new vp_dev->vqs array, causing NULL or mismatched virtio_pci_vq_info teardown that can corrupt heap metadata and disclose kernel memory beyond a simple bounded fault.
- I:HIntegrity impact, high
- The same mismatched vp_del_vq()/vp_del_vqs() teardown can corrupt kernel linked lists and free or misuse queue metadata, providing a plausible path to further memory corruption and control-flow hijack rather than only an immediate crash.
- A:HAvailability impact, high
- The documented failure mode is a NULL pointer dereference in vp_del_vq() during restore that oopses or panics the guest kernel, and a failed restore can also leave the system unable to resume cleanly from suspend/hibernate.