A small, surgical change to the Linux virtio networking code has closed a correctness hole that could let a hostile or malformed host announcement trigger a NULL page pointer dereference when guests receive very large packets; the fix — now tracked as CVE-2025-40292 — tightens the...