CVE-2026-97997

A low security impact flaw was found in the Linux kernel's virtio_ring handling of packed virtqueues. It affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9 and 10, the kernels shipped with Red Hat Enterprise Linux CoreOS 8 and 9 as used by OpenShift Container Platform 4, and Red Hat In-Vehicle OS 2. When adding a descriptor chain to a packed virtqueue fails partway, typically because a scatter-gather mapping fails under memory pressure in swiotlb configurations, the error path unmaps the mapped segments but leaves the AVAIL and USED status flags set on the descriptors already written. A local user with privileges to generate large I/O operations could, under these specific preconditions, cause a subsequent shorter request that reuses the same ring position to make the device consume stale descriptor entries, blocking the virtqueue and causing a denial of service limited to I/O on that device within the guest. Red Hat rates the security impact of this flaw as Low even though the CVSS:3.1 base score of 5.5 (Moderate) reflects the theoretical worst case, because exploitation requires the unlikely combination of packed virtqueues, swiotlb bounce buffering under memory pressure, and a subsequent shorter request at the same head, and the consequence is limited to availability of a single virtio device. Red Hat Enterprise Linux 7 is not affected because the packed virtqueue support that introduced this flaw is not present in that release. Fixes for the affected streams are currently deferred to a future update; the residual risk while the fix is deferred is a local denial of service against an affected virtio device, with no impact on confidentiality or integrity.