CVE-2026-23229: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23229 is a race condition vulnerability in the Linux kernel's virtio-crypto driver caused by missing spinlock protection during virtqueue notification handling. When a VM boots with a virtio-crypto PCI device and a builtin backend, concurrent cryptographic operations (e.g., multiple OpenSSL processes) can trigger data corruption and process hangs, with the kernel reporting errors such as virtio_crypto virtio0: dataq.0:id X is not a head!. The vulnerability was published on February 18, 2026, and affects numerous Linux kernel stable branches from 4.19 through 6.19. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Microsoft MSRC).

The root cause is a race condition (CWE-362) in the virtcrypto_done_task() function of the Linux kernel's crypto/virtio driver, where the data virtqueue lacks spinlock protection during virtio done notification processing. Without this protection, concurrent access from multiple processes performing cryptographic operations leads to data structure corruption — specifically, the virtqueue head tracking becomes inconsistent, causing the driver to misidentify queue entries. The fix involves adding spinlock protection around virtqueue notification handling in virtcrypto_done_task(). The attack vector is local, requiring low privileges, and is triggered by running multiple concurrent cryptographic workloads (e.g., openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32) on a system with a virtio-crypto PCI device (Red Hat CVE, git.kernel.org).

Successful exploitation results in a denial of service: affected OpenSSL or other cryptographic processes hang indefinitely, and the kernel logs errors indicating virtqueue corruption. There is no confidentiality or integrity impact — the vulnerability is limited to availability (CVSS A:H, C:N, I:N). Systems running virtio-crypto PCI devices in virtualized environments (including Microsoft Azure Linux CBL2 kernel 5.15.200.1-1 and AZL3 kernel 6.6.121.1-1) are particularly at risk when processing high-volume or multi-process cryptographic workloads (Red Hat CVE, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the latest update (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and a system configured with a virtio-crypto PCI device, limiting the practical attack surface to virtualized environments.

• Logs: Kernel messages containing virtio_crypto virtio0: dataq.0:id X is not a head! in /var/log/kern.log or dmesg output, indicating virtqueue corruption.
• Process Behavior: OpenSSL or other cryptographic processes entering a hung/unresponsive state when run with multiple concurrent workers (e.g., -multi 32) on systems with virtio-crypto devices.
• System: Elevated load or unresponsive cryptographic operations on VMs with virtio-crypto PCI devices attached, particularly under concurrent workload conditions.

Patches have been released across all affected stable kernel branches. Administrators should update to the following fixed versions or later: Linux kernel 5.4.x → 5.5+, 4.19.x → 4.20+, 5.10.x → 5.10.251+, 5.15.x → 5.15.201+, 6.1.x → 6.1.164+, 6.6.x → 6.6.125+, 6.7–6.12.x → 6.12.72+, 6.13–6.18.x → 6.18.11+, 6.19.x → 6.19.1+. Multiple upstream kernel commits address this issue (git.kernel.org). As a temporary workaround where patching is not immediately possible, restrict local user access to virtio-crypto devices or limit concurrent cryptographic operations. Debian, Oracle Linux, Amazon Linux 2, and Microsoft Azure Linux have all issued updated packages (Debian LTS, Microsoft MSRC).