CVE-2026-74311

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74311", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.883Z", "datePublished": "2026-08-15T05:58:10.711Z", "dateUpdated": "2026-08-17T05:45:43.827Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:43.827Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: rtc: tear down old virtqueues before restore\n\nvirtio_device_restore() resets the device and restores the negotiated\nfeatures before calling ->restore(). viortc_freeze() intentionally\nleaves the existing virtqueues in place so the alarm queue can still\nwake the system, but viortc_restore() immediately calls\nviortc_init_vqs() without first deleting those old queues.\n\nIf virtqueue reinitialization fails on virtio-pci, the transport error\npath can run vp_del_vqs() against a newly allocated vp_dev->vqs array\nwhile vdev->vqs still contains the old virtqueues. vp_del_vqs() then\nlooks up queue state through the new array and can dereference a NULL\ninfo pointer in vp_del_vq(), crashing the guest kernel during restore.\n\nThis can also happen during a non-faulty reinitialization, when one of\nthe vp_find_vqs_msix() attempts is unsuccessful before a later attempt\nwould succeed.\n\nDelete the stale virtqueues before rebuilding them. If restore fails\nbefore virtio_device_ready(), reuse the remove path to stop the device.\nOnce the device is ready, return errors directly instead of deleting the\nvirtqueues again."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through the kernel system sleep PM path (suspend/hibernate freeze/thaw/restore) that calls virtio_pci_restore() -> virtio_device_restore() -> viortc_restore(); it is not reachable from network packets, remote protocols, or physical device attachment.\nAC:L - Any actor who can drive a suspend/hibernate cycle on a guest with virtio-pci virtio_rtc can trigger restore; virtio-pci routinely retries MSI-X allocation policies and the commit notes the crash occurs on a failed attempt before a later one would succeed, so success does not depend on uncontrollable timing or layout.\nPR:L - Triggering suspend/hibernate/thaw is available to unprivileged local users on typical desktop, mobile, and embedded systems via logind/power interfaces or RTC alarm wake without requiring real root in the init namespace or capabilities unavailable in user namespaces.\nUI:N - Exploitation requires only initiating or allowing system suspend/hibernate and resume; no separate victim user action such as opening a file, mounting a filesystem, or clicking a prompt is needed beyond the attacker's own power-management trigger.\nS:U - The fault corrupts or crashes the same guest kernel that owns the virtio_rtc driver during PM restore; it does not cross a VM/host, IOMMU, or sandbox security boundary to impact a different authority.\nC:H - Failed virtqueue reinit leaves stale queues on vdev->vqs while vp_del_vqs() indexes a new vp_dev->vqs array, causing NULL or mismatched virtio_pci_vq_info teardown that can corrupt heap metadata and disclose kernel memory beyond a simple bounded fault.\nI:H - The same mismatched vp_del_vq()/vp_del_vqs() teardown can corrupt kernel linked lists and free or misuse queue metadata, providing a plausible path to further memory corruption and control-flow hijack rather than only an immediate crash.\nA:H - The documented failure mode is a NULL pointer dereference in vp_del_vq() during restore that oopses or panics the guest kernel, and a failed restore can also leave the system unable to resume cleanly from suspend/hibernate."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virtio/virtio_rtc_driver.c"], "versions": [{"version": "0623c759276885c3ae88197ba6fb5c9c6ba8612f", "lessThan": "79366023aa891ca31376021a7bccff6384ca1ff1", "status": "affected", "versionType": "git"}, {"version": "0623c759276885c3ae88197ba6fb5c9c6ba8612f", "lessThan": "aebebd1e9d70b650fc9e877082e0134edcf511da", "status": "affected", "versionType": "git"}, {"version": "0623c759276885c3ae88197ba6fb5c9c6ba8612f", "lessThan": "548d2208455f14e6121404c6e30e997bfe0cd264", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virtio/virtio_rtc_driver.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/79366023aa891ca31376021a7bccff6384ca1ff1"}, {"url": "https://git.kernel.org/stable/c/aebebd1e9d70b650fc9e877082e0134edcf511da"}, {"url": "https://git.kernel.org/stable/c/548d2208455f14e6121404c6e30e997bfe0cd264"}], "title": "virtio: rtc: tear down old virtqueues before restore", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/virtio/virtio_rtc_driver.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "79366023aa891ca31376021a7bccff6384ca1ff1", "status": "affected", "version": "0623c759276885c3ae88197ba6fb5c9c6ba8612f", "versionType": "git"}, {"lessThan": "aebebd1e9d70b650fc9e877082e0134edcf511da", "status": "affected", "version": "0623c759276885c3ae88197ba6fb5c9c6ba8612f", "versionType": "git"}, {"lessThan": "548d2208455f14e6121404c6e30e997bfe0cd264", "status": "affected", "version": "0623c759276885c3ae88197ba6fb5c9c6ba8612f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/virtio/virtio_rtc_driver.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: rtc: tear down old virtqueues before restore\n\nvirtio_device_restore() resets the device and restores the negotiated\nfeatures before calling ->restore(). viortc_freeze() intentionally\nleaves the existing virtqueues in place so the alarm queue can still\nwake the system, but viortc_restore() immediately calls\nviortc_init_vqs() without first deleting those old queues.\n\nIf virtqueue reinitialization fails on virtio-pci, the transport error\npath can run vp_del_vqs() against a newly allocated vp_dev->vqs array\nwhile vdev->vqs still contains the old virtqueues. vp_del_vqs() then\nlooks up queue state through the new array and can dereference a NULL\ninfo pointer in vp_del_vq(), crashing the guest kernel during restore.\n\nThis can also happen during a non-faulty reinitialization, when one of\nthe vp_find_vqs_msix() attempts is unsuccessful before a later attempt\nwould succeed.\n\nDelete the stale virtqueues before rebuilding them. If restore fails\nbefore virtio_device_ready(), reuse the remove path to stop the device.\nOnce the device is ready, return errors directly instead of deleting the\nvirtqueues again."}], "id": "CVE-2026-74311", "lastModified": "2026-08-17T06:19:25.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:31.173", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/548d2208455f14e6121404c6e30e997bfe0cd264"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/79366023aa891ca31376021a7bccff6384ca1ff1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aebebd1e9d70b650fc9e877082e0134edcf511da"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: virtio: rtc: tear down old virtqueues before restore", "id": "2516823", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516823"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel. During a system restore operation, the virtio real-time clock (RTC) component fails to properly manage virtual queues (virtqueues). If the reinitialization of these virtqueues fails, the system attempts to delete queues using incorrect memory references. This can lead to a null pointer dereference, causing the guest kernel to crash and resulting in a denial of service."], "name": "CVE-2026-74311", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74311\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74311\nhttps://lore.kernel.org/linux-cve-announce/2026081551-CVE-2026-74311-7f02@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0623c759276885c3ae88197ba6fb5c9c6ba8612f,79366023aa891ca31376021a7bccff6384ca1ff1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0623c759276885c3ae88197ba6fb5c9c6ba8612f,aebebd1e9d70b650fc9e877082e0134edcf511da)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0623c759276885c3ae88197ba6fb5c9c6ba8612f,548d2208455f14e6121404c6e30e997bfe0cd264)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.40,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.5,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T12:30:07.841832+00:00", "updated": "2026-08-17T14:00:21.438992+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}