CVE-2026-97952: Linux kernel · sunvdc: unmap LDC cookies when the descriptor send fails
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f3322baa3a8ac87730feae952c1146269d78e098 : patch Linux kernel soon.
Data as of 26 Oct 2026, 17:16 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in f3322baa3a8ac87730feae952c1146269d78e098, eb9c5f6747fe98b83c78cb5476a914e91d50e8e8, b0de6463667e9bb9dc14a83a9c24c1b6b3f7b5f7 +10
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in Linux kernel versions 4.15, 4.20, 4.21, and several intermediate versions as indicated by fixed commit hashes. Users should upgrade to these fixed versions to resolve the issue. No additional mitigation is required once the system is updated.
Description
A vulnerability in the Linux kernel's sunvdc driver causes a resource leak when sending descriptors fails. Specifically, when the __vdc_tx_trigger() function fails to send a descriptor, the associated LDC cookies remain mapped and are never unmapped, leading to permanent leakage of map table entries. This leak can cause fragmentation and eventual exhaustion of the map table, resulting in I/O errors and disk unavailability until reboot. Retry attempts exacerbate the issue by leaking more mappings. The flaw has been fixed by rolling back the mapping and resetting the descriptor state on failure.
References
- git.kernel.org/stable/c/eb9c5f6747fe98b83c78cb5476a914e91d50e8e8 (opens in a new tab)
- git.kernel.org/stable/c/24564576be423f3b5d7e67cd7df848ac66646497 (opens in a new tab)
- git.kernel.org/stable/c/9251573e7cf7d797ae4a30b2a236af8242237a61 (opens in a new tab)
- git.kernel.org/stable/c/b0de6463667e9bb9dc14a83a9c24c1b6b3f7b5f7 (opens in a new tab)
- git.kernel.org/stable/c/ab81a5c1014a38dab0fb402609fd866b0bcb4726 (opens in a new tab)
- git.kernel.org/stable/c/57835952566f0be9b365a6eb3a70b397a9d5ef47 (opens in a new tab)
- git.kernel.org/stable/c/f3322baa3a8ac87730feae952c1146269d78e098 (opens in a new tab)
- git.kernel.org/stable/c/0c6da21fa35e03fc74f09895433ccd6d4a9c3530 (opens in a new tab)