virtio net

CVE-2026-23340 has drawn attention because it sits squarely in a part of the Linux networking stack that most people never think about until something goes wrong: the qdisc layer that schedules packets before they hit a NIC. The bug is a race condition in the tx-queue shrinking path that can...

A subtle bug in QEMU’s virtio-net RSS implementation has been quietly remaking risk calculations for operators who run multi‑tenant or untrusted virtual machines: when RSS (Receive Side Scaling) is enabled for the virtio‑net device, an attacker with elevated privileges inside the guest can...

Azure Linux being named in Microsoft’s advisory is an important, actionable signal — but it is not a proof that no other Microsoft product contains the same vulnerable upstream code; Microsoft’s wording means Azure Linux is the only Microsoft product the company has completed and published an...

A small, surgical change to the Linux virtio networking code has closed a correctness hole that could let a hostile or malformed host announcement trigger a NULL page pointer dereference when guests receive very large packets; the fix — now tracked as CVE-2025-40292 — tightens the...