CVE-2026-64457

What it actually does

This is a Linux kernel virtio_pci defect that can trigger a NULL pointer dereference during removal of a virtio device, specifically demonstrated with virtio_balloon unbind operations. The bug is caused by an index mismatch between sparse virtqueue information entries and dense virtqueue indexes when optional virtio balloon queues are absent. During device teardown, the kernel looks up virtqueue metadata using the wrong index, may retrieve NULL, and then dereference it in the virtqueue deletion path. The practical technical result is a kernel crash or panic, producing a local denial of service for the affected Linux system or guest VM.

Why it matters to the business

Successful exploitation can crash an affected Linux host or virtual machine, causing service interruption, workload disruption, failed jobs, and potential availability incidents. Because the demonstrated trigger involves writing to sysfs driver unbind controls, exploitation generally requires local administrative privileges or a management path that can unbind virtio devices; however, in virtualized environments, even a guest-local crash can affect production application availability. The vulnerability is not currently listed in CISA KEV, has low EPSS, and has no reported exploit maturity, so urgency is primarily driven by whether affected systems use virtio balloon devices and whether untrusted or semi-trusted administrators can perform device-management operations.

How an attack unfolds

An attacker first needs local access with sufficient privilege to interact with kernel device-management interfaces, such as the ability to write to sysfs driver unbind files. On a Linux system using virtio PCI devices, the attacker identifies a virtio balloon device where some optional queues, such as stats, free_page, or reporting, are not present. They then trigger removal of the device, for example by writing the virtio device name to the virtio_balloon driver's unbind interface. During teardown, the kernel's virtio_pci code attempts to delete virtqueues. Because the virtqueue info pointer was stored using a sparse caller index but later retrieved using a dense virtqueue index, the lookup can return NULL. The kernel then dereferences the NULL pointer in the list deletion path, causing an oops, panic, or system crash depending on kernel configuration.

How to fix it

Apply a Linux kernel update that includes the virtio_pci fix storing virtqueue info at the dense queue_idx rather than the sparse caller index in both MSI-X and INTx paths. If vendor fixed versions are not yet identified, track the relevant Linux distribution, appliance, cloud image, hypervisor guest image, and kernel vendor advisories for this CVE and deploy the first kernel package that includes the upstream fix. Reboot systems after installing the corrected kernel unless live patching is explicitly provided and supported by the vendor. As interim mitigation, restrict local administrative access and any automation capable of writing to /sys/bus/virtio/drivers/*/unbind, avoid unnecessary virtio balloon unbind/rebind operations on affected kernels, and limit device-management permissions in container, virtualization, and orchestration workflows.

How to confirm the fix worked

Validate remediation by confirming the running kernel version is a vendor build that includes the virtio_pci queue index fix, not merely that the package is installed on disk. Check distribution changelogs or kernel source patches for changes in virtio_pci queue setup where vp_dev->vqs is indexed by queue_idx in the relevant MSI-X and INTx paths. On non-production test systems only, reproduce the previously failing operation by unbinding a virtio_balloon device and confirm the system no longer logs a NULL pointer dereference or crashes. Also confirm that access to sysfs driver unbind controls is limited to trusted administrative users and that monitoring captures kernel oops/panic events from dmesg, journald, kmsg, and centralized logging.

Typical attack path

1. Obtain local privileged access or another authorized path to write to Linux sysfs driver binding controls.
2. Confirm the system is using virtio PCI devices, particularly virtio_balloon.
3. Identify the virtio balloon device name under /sys/bus/virtio/devices/ or related sysfs paths.
4. Trigger device removal by writing the device identifier to /sys/bus/virtio/drivers/virtio_balloon/unbind.
5. The kernel enters the virtio device removal path and calls virtqueue deletion routines.
6. The virtio_pci code performs a mismatched virtqueue info lookup, receives a NULL pointer, and dereferences it.
7. The system logs a kernel NULL pointer dereference and may panic or crash, causing denial of service.

How to detect it

To determine whether this was already exploited or triggered, review kernel and system logs for oops, panic, or NULL pointer dereference events in the virtio balloon removal path. Primary sources include dmesg, /var/log/kern.log, /var/log/messages, journald kernel transport, /dev/kmsg captures, hypervisor console logs, crash dump metadata, and centralized SIEM logs. Look for writes to sysfs unbind paths if auditd, eBPF telemetry, shell history, EDR, or privileged command logging is available. Correlate any kernel crash with nearby command execution or file-write events targeting /sys/bus/virtio/drivers/virtio_balloon/unbind. Indicators are strongest when the stack trace includes vp_del_vqs, remove_common, virtballoon_remove, virtio_dev_remove, unbind_store, and a NULL pointer dereference at or near address 0000000000000008. Absence of these artifacts does not prove non-exploitation if kernel logs were not persisted across reboot or crash dumps were not collected.

• BUG: kernel NULL pointer dereference, address: 0000000000000008
• RIP: 0010:__list_del_entry_valid_or_report
• vp_del_vqs+
• remove_common+
• virtballoon_remove+
• virtio_dev_remove+
• device_release_driver_internal+
• unbind_store+
• /sys/bus/virtio/drivers/virtio_balloon/unbind
• echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind
• virtio_balloon/unbind
• kernel NULL pointer dereference
• Call Trace:
• kernfs_fop_write_iter
• vfs_write
• ksys_write

What your security team should do

• Inventory Linux systems and guest VMs using virtio PCI devices, especially those with virtio_balloon enabled.
• Prioritize patching production virtual machines, shared infrastructure, and systems where local administrative access is delegated to application, platform, or operations teams.
• Apply vendor kernel updates containing the virtio_pci fix and reboot into the corrected kernel.
• Restrict write access to sysfs driver unbind interfaces and review automation that unbinds or rebinds virtio devices.
• Monitor kernel logs for NULL pointer dereferences involving virtio_pci, virtio_balloon, vp_del_vqs, remove_common, or virtballoon_remove.
• Treat unexpected virtio_balloon unbind activity followed by a crash as a potential local denial-of-service event and investigate the initiating user or process.
• Because this issue is not currently KEV-listed and has low EPSS, align emergency response with exposure: patch during normal accelerated kernel maintenance unless affected systems are high-availability or administratively multi-tenant.