CVE-2026-97989

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vduse component where the vduse validate config() function only verifies the upper bound of the vq align variable. This allows invalid values to reach vring create virtqueue map(). Because split-ring helpers use align - 1 as a bit mask, the alignment must be a non-zero power of two. If a value of zero is used, vring size() drops the descriptor and available-ring parts, and vring init() leaves the used ring pointer as NULL. This can lead to a null-pointer dereference in the virtqueue kick prepare split() function when opening a virtio-net device created with vq align=0.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.