{"id":"CVE-2026-74311","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-74311","summary":"virtio: rtc: tear down old virtqueues before restore","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: rtc: tear down old virtqueues before restore\n\nvirtio_device_restore() resets the device and restores the negotiated\nfeatures before calling ->restore(). viortc_freeze() intentionally\nleaves the existing virtqueues in place so the alarm queue can still\nwake the system, but viortc_restore() immediately calls\nviortc_init_vqs() without first deleting those old queues.\n\nIf virtqueue reinitialization fails on virtio-pci, the transport error\npath can run vp_del_vqs() against a newly allocated vp_dev->vqs array\nwhile vdev->vqs still contains the old virtqueues. vp_del_vqs() then\nlooks up queue state through the new array and can dereference a NULL\ninfo pointer in vp_del_vq(), crashing the guest kernel during restore.\n\nThis can also happen during a non-faulty reinitialization, when one of\nthe vp_find_vqs_msix() attempts is unsuccessful before a later attempt\nwould succeed.\n\nDelete the stale virtqueues before rebuilding them. If restore fails\nbefore virtio_device_ready(), reuse the remove path to stop the device.\nOnce the device is ready, return errors directly instead of deleting the\nvirtqueues again.","published":"2026-08-15T05:58:10.711Z","modified":"2026-08-18T03:56:46.638351003Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.18.40"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/548d2208455f14e6121404c6e30e997bfe0cd264"},{"type":"WEB","url":"https://git.kernel.org/stable/c/79366023aa891ca31376021a7bccff6384ca1ff1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/aebebd1e9d70b650fc9e877082e0134edcf511da"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74311.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74311"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T03:56:46.638351003Z"}}