English version →
カテゴリ
CVE-2026-23143

virtio_net: Fix misalignment bug in struct virtnet_info

概要

virtio_net: Fix misalignment bug in struct virtnet_info

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In the Linux kernel, the following vulnerability has been resolved:

virtio_net: Fix misalignment bug in struct virtnet_info

Use the new TRAILING_OVERLAP() helper to fix a misalignment bug
along with the following warning:

drivers/net/virtio_net.c:429:46: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

This helper creates a union between a flexible-array member (FAM)
and a set of members that would otherwise follow it (in this case
u8 rss_hash_key_data[VIRTIO_NET_RSS_MAX_KEY_SIZE];). This
overlays the trailing members (rss_hash_key_data) onto the FAM
(hash_key_data) while keeping the FAM and the start of MEMBERS aligned.
The static_assert() ensures this alignment remains.

Notice that due to tail padding in flexible struct virtio_net_rss_config_trailer, rss_trailer.hash_key_data
(at offset 83 in struct virtnet_info) and rss_hash_key_data (at
offset 84 in struct virtnet_info) are misaligned by one byte. See
below:

struct virtio_net_rss_config_trailer {
__le16 max_tx_vq; /* 0 2 /
__u8 hash_key_length; /
2 1 /
__u8 hash_key_data[]; /
3 0 */

    /* size: 4, cachelines: 1, members: 3 */
    /* padding: 1 */
    /* last cacheline: 4 bytes */

};

struct virtnet_info {
...
struct virtio_net_rss_config_trailer rss_trailer; /* 80 4 */…

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Linux Kernel
[{"type":"ECOSYSTEM","events":[{"introduced":"6.15.0"},{"fixed":"6.18.7"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

参照URL

当サイトでは、アクセス解析と広告の効果測定のために Cookie を使います。株式会社Game のサイト共通の設定です。 詳しく