{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74311","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.883Z","datePublished":"2026-08-15T05:58:10.711Z","dateUpdated":"2026-08-17T05:45:43.827Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T05:45:43.827Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: rtc: tear down old virtqueues before restore\n\nvirtio_device_restore() resets the device and restores the negotiated\nfeatures before calling ->restore(). viortc_freeze() intentionally\nleaves the existing virtqueues in place so the alarm queue can still\nwake the system, but viortc_restore() immediately calls\nviortc_init_vqs() without first deleting those old queues.\n\nIf virtqueue reinitialization fails on virtio-pci, the transport error\npath can run vp_del_vqs() against a newly allocated vp_dev->vqs array\nwhile vdev->vqs still contains the old virtqueues. vp_del_vqs() then\nlooks up queue state through the new array and can dereference a NULL\ninfo pointer in vp_del_vq(), crashing the guest kernel during restore.\n\nThis can also happen during a non-faulty reinitialization, when one of\nthe vp_find_vqs_msix() attempts is unsuccessful before a later attempt\nwould succeed.\n\nDelete the stale virtqueues before rebuilding them. If restore fails\nbefore virtio_device_ready(), reuse the remove path to stop the device.\nOnce the device is ready, return errors directly instead of deleting the\nvirtqueues again."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through the kernel system sleep PM path (suspend/hibernate freeze/thaw/restore) that calls virtio_pci_restore() -> virtio_device_restore() -> viortc_restore(); it is not reachable from network packets, remote protocols, or physical device attachment.\nAC:L - Any actor who can drive a suspend/hibernate cycle on a guest with virtio-pci virtio_rtc can trigger restore; virtio-pci routinely retries MSI-X allocation policies and the commit notes the crash occurs on a failed attempt before a later one would succeed, so success does not depend on uncontrollable timing or layout.\nPR:L - Triggering suspend/hibernate/thaw is available to unprivileged local users on typical desktop, mobile, and embedded systems via logind/power interfaces or RTC alarm wake without requiring real root in the init namespace or capabilities unavailable in user namespaces.\nUI:N - Exploitation requires only initiating or allowing system suspend/hibernate and resume; no separate victim user action such as opening a file, mounting a filesystem, or clicking a prompt is needed beyond the attacker's own power-management trigger.\nS:U - The fault corrupts or crashes the same guest kernel that owns the virtio_rtc driver during PM restore; it does not cross a VM/host, IOMMU, or sandbox security boundary to impact a different authority.\nC:H - Failed virtqueue reinit leaves stale queues on vdev->vqs while vp_del_vqs() indexes a new vp_dev->vqs array, causing NULL or mismatched virtio_pci_vq_info teardown that can corrupt heap metadata and disclose kernel memory beyond a simple bounded fault.\nI:H - The same mismatched vp_del_vq()/vp_del_vqs() teardown can corrupt kernel linked lists and free or misuse queue metadata, providing a plausible path to further memory corruption and control-flow hijack rather than only an immediate crash.\nA:H - The documented failure mode is a NULL pointer dereference in vp_del_vq() during restore that oopses or panics the guest kernel, and a failed restore can also leave the system unable to resume cleanly from suspend/hibernate."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/virtio/virtio_rtc_driver.c"],"versions":[{"version":"0623c759276885c3ae88197ba6fb5c9c6ba8612f","lessThan":"79366023aa891ca31376021a7bccff6384ca1ff1","status":"affected","versionType":"git"},{"version":"0623c759276885c3ae88197ba6fb5c9c6ba8612f","lessThan":"aebebd1e9d70b650fc9e877082e0134edcf511da","status":"affected","versionType":"git"},{"version":"0623c759276885c3ae88197ba6fb5c9c6ba8612f","lessThan":"548d2208455f14e6121404c6e30e997bfe0cd264","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/virtio/virtio_rtc_driver.c"],"versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/79366023aa891ca31376021a7bccff6384ca1ff1"},{"url":"https://git.kernel.org/stable/c/aebebd1e9d70b650fc9e877082e0134edcf511da"},{"url":"https://git.kernel.org/stable/c/548d2208455f14e6121404c6e30e997bfe0cd264"}],"title":"virtio: rtc: tear down old virtqueues before restore","x_generator":{"engine":"bippy-1.2.0"}}}}