sunvdc: unmap LDC cookies when the descriptor send fails
In the Linux kernel, the following vulnerability has been resolved: sunvdc: unmap LDC cookies when the descriptor send fails __send_request() maps the request's pages into the LDC channel's map table (ldc_map_sg()), fills in the descriptor and marks it VIO_DESC_READY before ringing the doorbell via __vdc_tx_trigger(). When the trigger fails, the error path only prints a message: the descriptor stays READY and the cookies are never unmapped. The mapping is normally released in vdc_end_one() when the peer completes the descriptor - but a descriptor whose doorbell was never sent will never complete, and since dr->prod is not advanced on failure, the reset path (vdc_requeue_inflight(), which walks [cons, prod)) never visits it either. The map table entries are leaked permanently. Since commit a11f6ca9aef9 ("sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN") trigger failures occur in practice under load, so every resulting I/O error also leaks one request's worth of entries from the fixed-size (8192 entries per channel) map table. Because the allocator hands out contiguous ranges, fragmentation makes large multi-segment requests fail first as the table drains, until ldc_map_sg() fails permanently and the disk is dead until reboot. It also makes any retry-based recovery unusable: requeuing the request on -EAGAIN remaps the pages on every attempt, overwriting desc->cookies and orphaning the previous mapping, so the table drains at the retry rate. This is th
CVE-2026-97952
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-97952
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec",
"lessThan": "eb9c5f6747fe98b83c78cb5476a914e91d50e8e8",
"versionType": "git"
},
{
"status": "affected",
"version": "a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec",
"lessThan": "24564576be423f3b5d7e67cd7df848ac66646497",
"versionType": "git"
},
{
"status": "affected",
"version": "a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec",
"lessThan": "9251573e7cf7d797ae4a30b2a236af8242237a61",
"versionType": "git"
},
{
"status": "affected",
"version": "a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec",
"lessThan": "b0de6463667e9bb9dc14a83a9c24c1b6b3f7b5f7",
"versionType": "git"
},
{
"status": "affected",
"version": "a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec",
"lessThan": "ab81a5c1014a38dab0fb402609fd866b0bcb4726",
"versionType": "git"
},
{
"status": "affected",
"version": "a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec",
"lessThan": "57835952566f0be9b365a6eb3a70b397a9d5ef47",
"versionType": "git"
},
{
"status": "affected",
"version": "a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec",
"lessThan": "f3322baa3a8ac87730feae952c1146269d78e098",
"versionType": "git"
},
{
"status": "affected",
"version": "a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec",
"lessThan": "0c6da21fa35e03fc74f09895433ccd6d4a9c3530",
"versionType": "git"
},
{
"status": "affected",
"version": "627e656239c63d8a81672d08de7885e89c12fa75",
"versionType": "git"
},
{
"status": "affected",
"version": "a1ef7d5da9b2c145f811a80bb8197df6037a7572",
"versionType": "git"
},
{
"status": "affected",
"version": "7ab4b6526fdcdfa7772984bbcd2ac4fd14fa223b",
"versionType": "git"
},
{
"status": "affected",
"version": "3fbba4e55051d01a72b56ea192064175924bf56a",
"versionType": "git"
},
{
"status": "affected",
"version": "3e380fc2ae4d18210eec9c472b12e2b2544f7dc1",
"versionType": "git"
},
{
"status": "affected",
"version": "4.4.175",
"lessThan": "4.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.9.156",
"lessThan": "4.10",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.14.99",
"lessThan": "4.15",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.19.21",
"lessThan": "4.20",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.20.8",
"lessThan": "4.21",
"versionType": "semver"
}
],
"programFiles": [
"drivers/block/sunvdc.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/block/sunvdc.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-97952
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38093 · Revision 1
- Added to Heist Feed
- Publisher date