The Linux kernel's virtio_pci driver had a vulnerability (CVE-2026-64457) where unbinding a virtio balloon device triggered a NULL pointer dereference. The root cause was an indexing mismatch between the sparse array index used to store virtqueue info pointers and the dense index used during lookup. Specifically, vp_find_vqs_msix() and vp_find_vqs_intx() stored info pointers at vp_dev->vqs[i] where 'i' was sparse, but the virtqueue's vq->index was dense, skipping NULL entries. Later, vp_del_vqs() used the dense index to look up info pointers, causing NULL dereference when holes existed. The fix involved storing info pointers at vp_dev->vqs[queue_idx] to align storage and lookup indices, applied to both MSIX and INTX interrupt paths.

The vulnerability causes a kernel NULL pointer dereference leading to a system crash (kernel panic) when unbinding a virtio balloon device under certain conditions. This results in denial of service but does not indicate privilege escalation or code execution based on the provided data.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the indexing logic in the virtio_pci driver. Users should apply the official kernel updates that include this fix. Since no vendor advisory or patch links are provided, check the Linux kernel mailing lists or official repositories for the relevant patch and update accordingly. Patch status is not yet confirmed from vendor advisory; verify current remediation guidance from official Linux kernel sources.