CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

virtio_pci: fix vq info pointer lookup via wrong index

Unbinding a virtio balloon device:

    echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind

triggers a NULL pointer dereference. The dmesg says:

    BUG: kernel NULL pointer dereference, address: 0000000000000008
    [...]
    RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0
    Call Trace:
    <TASK>
    vp_del_vqs+0x121/0x230
    remove_common+0x135/0x150
    virtballoon_remove+0xee/0x100
    virtio_dev_remove+0x3b/0x80
    device_release_driver_internal+0x187/0x2c0
    unbind_store+0xb9/0xe0
    kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180
    vfs_write+0x2a9/0x3b0
    ksys_write+0x5c/0xd0
    do_syscall_64+0x54/0x230
    entry_SYSCALL_64_after_hwframe+0x29/0x31
    [...]
    </TASK>

The virtio_balloon device registers 5 queues (inflate, deflate, stats,
free_page, reporting) but only the first two are unconditional. The
stats, free_page and reporting queues are each conditional on their
respective feature bits. When any of these features are absent, the
corresponding vqs_info entry has name == NULL, creating holes in the
array.

The root cause is an indexing mismatch introduced when vq info storage
was changed to be passed as an argument. vp_find_vqs_msix() and
vp_find_vqs_intx() store the info pointer at vp_dev->vqs[i], where 'i'
is the caller's sparse array index. However, the virtqueue itself gets
vq->index assigned from queue_idx, a dense index that skips NULL
entries. When holes exist, 'i' and queue_idx diverge. Later,
vp_del_vqs() looks up info via vp_dev->vqs[vq->index] using the dense
index into the sparsely-populated array, and hits NULL.

Fix this by storing info at vp_dev->vqs[queue_idx] instead of
vp_dev->vqs[i], so the store index matches the lookup index
(vq->index). Apply the fix to both the MSIX and INTX paths.

The Linux kernel CVE team has assigned CVE-2026-64457 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.11 with commit 89a1c435aec269d109ed46ca7bbb10fa8edf7ace and fixed in 6.12.96 with commit 41e6dc1a10036c9f47057033f19af7e52ec464b6
	Issue introduced in 6.11 with commit 89a1c435aec269d109ed46ca7bbb10fa8edf7ace and fixed in 6.18.39 with commit 075bc3c779e1ea7294afabdcb7e0a49536959b28
	Issue introduced in 6.11 with commit 89a1c435aec269d109ed46ca7bbb10fa8edf7ace and fixed in 7.1.4 with commit 64a4c0befa77bcc01076aec9f93863ffd4ed06b7
	Issue introduced in 6.11 with commit 89a1c435aec269d109ed46ca7bbb10fa8edf7ace and fixed in 7.2-rc1 with commit f7d380fb525c13bdd114369a1979c80c346e6abc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64457
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/virtio/virtio_pci_common.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/41e6dc1a10036c9f47057033f19af7e52ec464b6
	https://git.kernel.org/stable/c/075bc3c779e1ea7294afabdcb7e0a49536959b28
	https://git.kernel.org/stable/c/64a4c0befa77bcc01076aec9f93863ffd4ed06b7
	https://git.kernel.org/stable/c/f7d380fb525c13bdd114369a1979c80c346e6abc