CVE-2026-23229

NameCVE-2026-23229
DescriptionIn the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add spinlock protection with virtqueue notification When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes, such as openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32 openssl processes will hangup and there is error reported like this: virtio_crypto virtio0: dataq.0:id 3 is not a head! It seems that the data virtqueue need protection when it is handled for virtio done notification. If the spinlock protection is added in virtcrypto_done_task(), openssl benchmark with multiple processes works well.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6141-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)bullseye5.10.223-1vulnerable
bullseye (security)5.10.249-1vulnerable
bookworm6.1.159-1vulnerable
bookworm (security)6.1.162-1vulnerable
trixie6.12.63-1vulnerable
trixie (security)6.12.73-1fixed
forky6.18.15-1fixed
sid6.19.6-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcetrixie6.12.73-1DSA-6141-1
linuxsource(unstable)6.18.12-1

Notes

https://git.kernel.org/linus/b505047ffc8057555900d2d3a005d033e6967382 (7.0-rc1)

Search for package or bug name: Reporting problems