{"id":"CVE-2026-23143","title":"virtio_net: Fix misalignment bug in struct virtnet_info","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix misalignment bug in struct virtnet_info\n\nUse the new TRAILING_OVERLAP() helper to fix a misalignment bug\nalong with the following warning:\n\ndrivers/net/…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 4c47aff10f6f0a2506dc2126c17ccd4c42bfa211 < d1e9614a142eff34c93e94a15a71ad0e806799c4","Linux >= ed3100e90d0d120a045a551b85eb43cf2527e885 < ae48108c2310f1dd700e0dbb655c2f1d92ed00fc","Linux >= ed3100e90d0d120a045a551b85eb43cf2527e885 < 4156c3745f06bc197094b9ee97a9584e69ed00bf","Linux >= 6.12.91 < 6.12.114","Linux 6.15"],"published":"2026-02-14","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:38:54.971Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23143","references":[{"url":"https://git.kernel.org/stable/c/d1e9614a142eff34c93e94a15a71ad0e806799c4"},{"url":"https://git.kernel.org/stable/c/ae48108c2310f1dd700e0dbb655c2f1d92ed00fc"},{"url":"https://git.kernel.org/stable/c/4156c3745f06bc197094b9ee97a9584e69ed00bf"}],"tags":["cve.org"],"epss":0.00174,"epssPercentile":0.06823,"ingestedAt":"2026-10-21T12:48:53.671Z","slug":"CVE-2026-23143","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix misalignment bug in struct virtnet_info\n\nUse the new TRAILING_OVERLAP() helper to fix a misalignment bug\nalong with the following warning:\n\ndrivers/net/virtio_net.c:429:46: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]\n\nThis helper creates a union between a flexible-array member (FAM)\nand a set of members that would otherwise follow it (in this case\n`u8 rss_hash_key_data[VIRTIO_NET_RSS_MAX_KEY_SIZE];`). This\noverlays the trailing members (rss_hash_key_data) onto the FAM\n(hash_key_data) while keeping the FAM and the start of MEMBERS aligned.\nThe static_assert() ensures this alignment remains.\n\nNotice that due to tail padding in flexible `struct\nvirtio_net_rss_config_trailer`, `rss_trailer.hash_key_data`\n(at offset 83 in struct virtnet_info) and `rss_hash_key_data` (at\noffset 84 in struct virtnet_info) are misaligned by one byte. See\nbelow:\n\nstruct virtio_net_rss_config_trailer {\n        __le16                     max_tx_vq;            /*     0     2 */\n        __u8                       hash_key_length;      /*     2     1 */\n        __u8                       hash_key_data[];      /*     3     0 */\n\n        /* size: 4, cachelines: 1, members: 3 */\n        /* padding: 1 */\n        /* last cacheline: 4 bytes */\n};\n\nstruct virtnet_info {\n...\n        struct virtio_net_rss_config_trailer rss_trailer; /*    80     4 */\n\n        /* XXX last struct has 1 byte of padding */\n\n        u8                         rss_hash_key_data[40]; /*    84    40 */\n...\n        /* size: 832, cachelines: 13, members: 48 */\n        /* sum members: 801, holes: 8, sum holes: 31 */\n        /* paddings: 2, sum paddings: 5 */\n};\n\nAfter changes, those members are correctly aligned at offset 795:\n\nstruct virtnet_info {\n...\n        union {\n                struct virtio_net_rss_config_trailer rss_trailer; /*   792     4 */\n                struct {\n                        unsigned char __offset_to_hash_key_data[3]; /*   792     3 */\n                        u8         rss_hash_key_data[40]; /*   795    40 */\n                };                                       /*   792    43 */\n        };                                               /*   792    44 */\n...\n        /* size: 840, cachelines: 14, members: 47 */\n        /* sum members: 801, holes: 8, sum holes: 35 */\n        /* padding: 4 */\n        /* paddings: 1, sum paddings: 4 */\n        /* last cacheline: 8 bytes */\n};\n\nAs a result, the RSS key passed to the device is shifted by 1\nbyte: the last byte is cut off, and instead a (possibly\nuninitialized) byte is added at the beginning.\n\nAs a last note `struct virtio_net_rss_config_hdr *rss_hdr;` is also\nmoved to the end, since it seems those three members should stick\naround together. :)\n\n## Affected\n\n- `Linux >= 4c47aff10f6f0a2506dc2126c17ccd4c42bfa211 < d1e9614a142eff34c93e94a15a71ad0e806799c4`\n- `Linux >= ed3100e90d0d120a045a551b85eb43cf2527e885 < ae48108c2310f1dd700e0dbb655c2f1d92ed00fc`\n- `Linux >= ed3100e90d0d120a045a551b85eb43cf2527e885 < 4156c3745f06bc197094b9ee97a9584e69ed00bf`\n- `Linux >= 6.12.91 < 6.12.114`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}