virtio_pci: Fix admin vq cleanup by using correct info pointer

Summary

CVE	CVE-2024-53092
State	PUBLISHED
Assigner	Linux
Source Priority	CVE Program / NVD first with legacy fallback
Published	2024-11-21 19:15:12 UTC
Updated	2026-08-04 11:21:50 UTC
Description	In the Linux kernel, the following vulnerability has been resolved: virtio_pci: Fix admin vq cleanup by using correct info pointer vp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq resources by virtio_pci_vq_info pointer. The info pointer of admin vq is stored in vp_dev->admin_vq.info instead of vp_dev->vqs[]. Using the info pointer from vp_dev->vqs[] for admin vq causes a kernel NULL pointer dereference bug. In vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer from vp_dev->admin_vq.info for admin vq to clean up the resources. Also make info ptr as argument of vp_del_vq() to be symmetric with vp_setup_vq(). vp_reset calls vp_modern_avq_cleanup, and causes the Call Trace: ================================================================== BUG: kernel NULL pointer dereference, address:0000000000000000 ... CPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1 RIP: 0010:vp_reset+0x57/0x90 [virtio_pci] Call Trace: <TASK> ... ? vp_reset+0x57/0x90 [virtio_pci] ? vp_reset+0x38/0x90 [virtio_pci] virtio_reset_device+0x1d/0x30 remove_vq_common+0x1c/0x1a0 [virtio_net] virtnet_remove+0xa1/0xc0 [virtio_net] virtio_dev_remove+0x46/0xa0 ... virtio_pci_driver_exit+0x14/0x810 [virtio_pci] ==================================================================

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.002030000 probability, percentile 0.103680000 (date 2026-08-06)

Problem Types: CWE-476 | CWE-476 CWE-476 NULL Pointer Dereference

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
3.1	ADP	DECLARED	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
3.1	416baaa9-dc9f-4396-8d5f-8c081fb06d67	Secondary	8.4	HIGH	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
3.1	CNA	DECLARED	8.4	HIGH	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Linux	Linux Kernel	All	All	All	All
Operating System	Linux	Linux Kernel	6.12	rc1	All	All
Operating System	Linux	Linux Kernel	6.12	rc2	All	All
Operating System	Linux	Linux Kernel	6.12	rc3	All	All
Operating System	Linux	Linux Kernel	6.12	rc4	All	All
Operating System	Linux	Linux Kernel	6.12	rc5	All	All
Operating System	Linux	Linux Kernel	6.12	rc6	All	All
Operating System	Linux	Linux Kernel	6.12	rc7	All	All

Source	Vendor	Product	Version	Platforms
CNA	Linux	Linux	affected 4c3b54af907e709609d3d8beca92d65e2f0cfd83 018d3d4ad4be7fbc95d8a2367642a32d21df55c7 git	Not specified
CNA	Linux	Linux	affected 4c3b54af907e709609d3d8beca92d65e2f0cfd83 97ee04feb682c906a1fa973ebe586fe91567d165 git	Not specified
CNA	Linux	Linux	affected 6.11	Not specified
CNA	Linux	Linux	unaffected 6.11 semver	Not specified
CNA	Linux	Linux	unaffected 6.11.9 6.11.* semver	Not specified
CNA	Linux	Linux	unaffected 6.12 * original_commit_for_fix	Not specified

Reference	Source	Link	Tags
git.kernel.org/stable/c/018d3d4ad4be7fbc95d8a2367642a32d21df55c7	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
git.kernel.org/stable/c/97ee04feb682c906a1fa973ebe586fe91567d165	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.