{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.96-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.4-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  virtio_pci: fix vq info pointer lookup via wrong index  Unbinding a virtio balloon device:      echo virtio0 \u003e /sys/bus/virtio/drivers/virtio_balloon/unbind  triggers a NULL pointer dereference. The dmesg says:      BUG: kernel NULL pointer dereference, address: 0000000000000008     [...]     RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0     Call Trace:     \u003cTASK\u003e     vp_del_vqs+0x121/0x230     remove_common+0x135/0x150     virtballoon_remove+0xee/0x100     virtio_dev_remove+0x3b/0x80     device_release_driver_internal+0x187/0x2c0     unbind_store+0xb9/0xe0     kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180     vfs_write+0x2a9/0x3b0     ksys_write+0x5c/0xd0     do_syscall_64+0x54/0x230     entry_SYSCALL_64_after_hwframe+0x29/0x31     [...]     \u003c/TASK\u003e  The virtio_balloon device registers 5 queues (inflate, deflate, stats, free_page, reporting) but only the first two are unconditional. The stats, free_page and reporting queues are each conditional on their respective feature bits. When any of these features are absent, the corresponding vqs_info entry has name == NULL, creating holes in the array.  The root cause is an indexing mismatch introduced when vq info storage was changed to be passed as an argument. vp_find_vqs_msix() and vp_find_vqs_intx() store the info pointer at vp_dev-\u003evqs[i], where 'i' is the caller's sparse array index. However, the virtqueue itself gets vq-\u003eindex assigned from queue_idx, a dense index that skips NULL entries. When holes exist, 'i' and queue_idx diverge. Later, vp_del_vqs() looks up info via vp_dev-\u003evqs[vq-\u003eindex] using the dense index into the sparsely-populated array, and hits NULL.  Fix this by storing info at vp_dev-\u003evqs[queue_idx] instead of vp_dev-\u003evqs[i], so the store index matches the lookup index (vq-\u003eindex). Apply the fix to both the MSIX and INTX paths.",
  "id": "DEBIAN-CVE-2026-64457",
  "modified": "2026-09-14T16:47:40.180897763Z",
  "published": "2026-07-25T10:17:30.830Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64457"
    }
  ],
  "upstream": [
    "CVE-2026-64457"
  ]
}