virtio_net: Fix misalignment bug in struct virtnet_info
Summary
virtio_net: Fix misalignment bug in struct virtnet_info
Original description
The description as published by the source.
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Fix misalignment bug in struct virtnet_info
Use the new TRAILING_OVERLAP() helper to fix a misalignment bug
along with the following warning:
drivers/net/virtio_net.c:429:46: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
This helper creates a union between a flexible-array member (FAM)
and a set of members that would otherwise follow it (in this case
u8 rss_hash_key_data[VIRTIO_NET_RSS_MAX_KEY_SIZE];). This
overlays the trailing members (rss_hash_key_data) onto the FAM
(hash_key_data) while keeping the FAM and the start of MEMBERS aligned.
The static_assert() ensures this alignment remains.
Notice that due to tail padding in flexible struct virtio_net_rss_config_trailer, rss_trailer.hash_key_data
(at offset 83 in struct virtnet_info) and rss_hash_key_data (at
offset 84 in struct virtnet_info) are misaligned by one byte. See
below:
struct virtio_net_rss_config_trailer {
__le16 max_tx_vq; /* 0 2 /
__u8 hash_key_length; / 2 1 /
__u8 hash_key_data[]; / 3 0 */
/* size: 4, cachelines: 1, members: 3 */
/* padding: 1 */
/* last cacheline: 4 bytes */
};
struct virtnet_info {
...
struct virtio_net_rss_config_trailer rss_trailer; /* 80 4 */…
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- BellSoft Alpaquita BELL-CVE-2026-23143 linux-lts
- Debian DEBIAN-CVE-2026-23143 linux Fixed in: 6.18.8-1
- Ubuntu UBUNTU-CVE-2026-23143 linux-hwe-edge
References
- advisory github.com
- advisory nvd.nist.gov
- package git.kernel.org
- web git.kernel.org
- web git.kernel.org