CVE-2026-98264

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98264", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.332Z", "datePublished": "2026-10-06T08:45:27.657Z", "dateUpdated": "2026-10-30T12:37:59.365Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:37:59.365Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: reset device before deleting virtqueues\n\nvirtsnd_remove() and virtsnd_freeze() delete the virtqueues before\nresetting the device. del_vqs() frees the vring backing, but does not\nprovide a generic device quiesce operation. In particular, modern\nvirtio-pci keeps enabled queues active until the device is reset.\n\nReset the device before deleting the virtqueues so it can no longer\naccess the vring memory when that memory is released. This also covers\nprobe failures after DRIVER_OK, which unwind through virtsnd_remove()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/virtio/virtio_card.c"], "versions": [{"version": "de3a9980d8c34b2479173e809afa820473db676a", "lessThan": "c0156a60adfb351b15ff25fbd76a0c639e96246c", "status": "affected", "versionType": "git"}, {"version": "de3a9980d8c34b2479173e809afa820473db676a", "lessThan": "8edc3669e3e22f0123a1114c3a03df9abc4cd465", "status": "affected", "versionType": "git"}, {"version": "de3a9980d8c34b2479173e809afa820473db676a", "lessThan": "830012feadc228a938514a6487862dcf56af7e66", "status": "affected", "versionType": "git"}, {"version": "de3a9980d8c34b2479173e809afa820473db676a", "lessThan": "500a8401415ab085555785c3c339747e378abd36", "status": "affected", "versionType": "git"}, {"version": "de3a9980d8c34b2479173e809afa820473db676a", "lessThan": "3e24b4a6acfd3bedb2200334595facd767c9a897", "status": "affected", "versionType": "git"}, {"version": "de3a9980d8c34b2479173e809afa820473db676a", "lessThan": "f070cce7cb361d5389b18f3ff6bd3d25a7596369", "status": "affected", "versionType": "git"}, {"version": "de3a9980d8c34b2479173e809afa820473db676a", "lessThan": "6c05d00af307560e6a9f1631d6270d3df5aa2272", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/virtio/virtio_card.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c0156a60adfb351b15ff25fbd76a0c639e96246c"}, {"url": "https://git.kernel.org/stable/c/8edc3669e3e22f0123a1114c3a03df9abc4cd465"}, {"url": "https://git.kernel.org/stable/c/830012feadc228a938514a6487862dcf56af7e66"}, {"url": "https://git.kernel.org/stable/c/500a8401415ab085555785c3c339747e378abd36"}, {"url": "https://git.kernel.org/stable/c/3e24b4a6acfd3bedb2200334595facd767c9a897"}, {"url": "https://git.kernel.org/stable/c/f070cce7cb361d5389b18f3ff6bd3d25a7596369"}, {"url": "https://git.kernel.org/stable/c/6c05d00af307560e6a9f1631d6270d3df5aa2272"}], "title": "ALSA: virtio: reset device before deleting virtqueues", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/virtio/virtio_card.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c0156a60adfb351b15ff25fbd76a0c639e96246c", "status": "affected", "version": "de3a9980d8c34b2479173e809afa820473db676a", "versionType": "git"}, {"lessThan": "8edc3669e3e22f0123a1114c3a03df9abc4cd465", "status": "affected", "version": "de3a9980d8c34b2479173e809afa820473db676a", "versionType": "git"}, {"lessThan": "830012feadc228a938514a6487862dcf56af7e66", "status": "affected", "version": "de3a9980d8c34b2479173e809afa820473db676a", "versionType": "git"}, {"lessThan": "500a8401415ab085555785c3c339747e378abd36", "status": "affected", "version": "de3a9980d8c34b2479173e809afa820473db676a", "versionType": "git"}, {"lessThan": "3e24b4a6acfd3bedb2200334595facd767c9a897", "status": "affected", "version": "de3a9980d8c34b2479173e809afa820473db676a", "versionType": "git"}, {"lessThan": "f070cce7cb361d5389b18f3ff6bd3d25a7596369", "status": "affected", "version": "de3a9980d8c34b2479173e809afa820473db676a", "versionType": "git"}, {"lessThan": "6c05d00af307560e6a9f1631d6270d3df5aa2272", "status": "affected", "version": "de3a9980d8c34b2479173e809afa820473db676a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/virtio/virtio_card.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: reset device before deleting virtqueues\n\nvirtsnd_remove() and virtsnd_freeze() delete the virtqueues before\nresetting the device. del_vqs() frees the vring backing, but does not\nprovide a generic device quiesce operation. In particular, modern\nvirtio-pci keeps enabled queues active until the device is reset.\n\nReset the device before deleting the virtqueues so it can no longer\naccess the vring memory when that memory is released. This also covers\nprobe failures after DRIVER_OK, which unwind through virtsnd_remove()."}], "id": "CVE-2026-98264", "lastModified": "2026-10-30T13:21:12.603", "metrics": {}, "published": "2026-10-06T09:18:15.650", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3e24b4a6acfd3bedb2200334595facd767c9a897"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/500a8401415ab085555785c3c339747e378abd36"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6c05d00af307560e6a9f1631d6270d3df5aa2272"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/830012feadc228a938514a6487862dcf56af7e66"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8edc3669e3e22f0123a1114c3a03df9abc4cd465"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c0156a60adfb351b15ff25fbd76a0c639e96246c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f070cce7cb361d5389b18f3ff6bd3d25a7596369"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: virtio: reset device before deleting virtqueues", "id": "2546477", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546477"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: virtio: reset device before deleting virtqueues\nvirtsnd_remove() and virtsnd_freeze() delete the virtqueues before\nresetting the device. del_vqs() frees the vring backing, but does not\nprovide a generic device quiesce operation. In particular, modern\nvirtio-pci keeps enabled queues active until the device is reset.\nReset the device before deleting the virtqueues so it can no longer\naccess the vring memory when that memory is released. This also covers\nprobe failures after DRIVER_OK, which unwind through virtsnd_remove().", "A flaw was found in the Advanced Linux Sound Architecture (ALSA) virtio sound driver in the Linux kernel. During device removal or system suspend operations, virtual queues are deleted before the virtual device is reset, allowing the device to access queue memory buffers after they have been freed. An attacker could exploit this improper cleanup sequence to trigger a use-after-free condition, potentially leading to kernel memory corruption or a Denial of Service (DoS) through a system crash."], "name": "CVE-2026-98264", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98264\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98264\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98264.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de3a9980d8c34b2479173e809afa820473db676a,8edc3669e3e22f0123a1114c3a03df9abc4cd465)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de3a9980d8c34b2479173e809afa820473db676a,830012feadc228a938514a6487862dcf56af7e66)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de3a9980d8c34b2479173e809afa820473db676a,500a8401415ab085555785c3c339747e378abd36)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de3a9980d8c34b2479173e809afa820473db676a,3e24b4a6acfd3bedb2200334595facd767c9a897)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de3a9980d8c34b2479173e809afa820473db676a,f070cce7cb361d5389b18f3ff6bd3d25a7596369)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[de3a9980d8c34b2479173e809afa820473db676a,6c05d00af307560e6a9f1631d6270d3df5aa2272)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T14:15:17.996551+00:00", "updated": "2026-10-11T04:45:17.732603+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}