EUVD-2026-59458
GHSA-4fvg-c4gx-gxg2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H because virtio-rtc device presence plus reinitialization failure are both required; impact is guest kernel panic only, so C:N and I:N.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
virtio: rtc: tear down old virtqueues before restore
virtio_device_restore() resets the device and restores the negotiated features before calling ->restore(). viortc_freeze() intentionally leaves the existing virtqueues in place so the alarm queue can still wake the system, but viortc_restore() immediately calls viortc_init_vqs() without first deleting those old queues.
If virtqueue reinitialization fails on virtio-pci, the transport error path can run vp_del_vqs() against a newly allocated vp_dev->vqs array while vdev->vqs still contains the old virtqueues. vp_del_vqs() then looks up queue state through the new array and can dereference a NULL info pointer in vp_del_vq(), crashing the guest kernel during restore.
This can also happen during a non-faulty reinitialization, when one of the vp_find_vqs_msix() attempts is unsuccessful before a later attempt would succeed.
Delete the stale virtqueues before rebuilding them. If restore fails before virtio_device_ready(), reuse the remove path to stop the device. Once the device is ready, return errors directly instead of deleting the virtqueues again.
AnalysisAI
Guest kernel crash in the Linux virtio RTC driver occurs during device restore when stale virtqueues are not cleaned up before reinitialization. Systems running virtual machines with a virtio-rtc device exposed are affected across Linux kernel versions up to 6.18.40 and 7.1.5 stable series. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) a virtio-rtc device must be exposed to the guest VM - this is a specific virtual device, not universally present in all VM configurations; (2) the guest must enter a freeze/restore cycle (system suspend or hibernation); and (3) virtqueue reinitialization in viortc_restore() must encounter a failure during the error path of vp_find_vqs_msix(), or an unsuccessful intermediate attempt before a later attempt succeeds. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as High severity with High impact across all three CIA pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with local low-privileged access to a guest VM configured with a virtio-rtc device triggers a system suspend/resume cycle, either by manipulating power management interfaces or by waiting for a legitimate administrative operation. If the virtqueue reinitialization in vp_find_vqs_msix() encounters a transient error or resource constraint during restore, the virtio-pci error path invokes vp_del_vqs() against a mismatched vqs array, dereferencing a NULL pointer and crashing the guest kernel with a kernel panic. … |
| Remediation | The primary remediation is to update the Linux kernel to a patched stable release: 6.18.40 or later in the 6.x series, or 7.1.5 or later in the 7.x series. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux kernel versions 6.18.40 and earlier in the 6.18.x series or 7.1.5 and earlier in the 7.1.x series with virtio-RTC devices enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today