CVE-2026-74311

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

virtio: rtc: tear down old virtqueues before restore

virtio_device_restore() resets the device and restores the negotiated

features before calling ->restore(). viortc_freeze() intentionally

leaves the existing virtqueues in place so the alarm queue can still

wake the system, but viortc_restore() immediately calls

viortc_init_vqs() without first deleting those old queues.

If virtqueue reinitialization fails on virtio-pci, the transport error

path can run vp_del_vqs() against a newly allocated vp_dev->vqs array

while vdev->vqs still contains the old virtqueues. vp_del_vqs() then

looks up queue state through the new array and can dereference a NULL

info pointer in vp_del_vq(), crashing the guest kernel during restore.

This can also happen during a non-faulty reinitialization, when one of

the vp_find_vqs_msix() attempts is unsuccessful before a later attempt

would succeed.

Delete the stale virtqueues before rebuilding

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References