Medium 5.5Published Feb 18, 2026

CVE-2026-23229crypto: virtio - Add spinlock protection with virtqueue notification

Updated under an hour ago (Oct 26, 2026, 10:30 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add spinlock protection with virtqueue notification When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes, such as openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32 openssl processes will hangup and there is error reported like this: virtio_crypto virtio0: dataq.0:id 3 is not a head! It seems that the data virtqueue need protection when it is handled for virtio done notification. If the spinlock protection is added in virtcrypto_done_task(), openssl benchmark with multiple processes works well.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Jun 2, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 0eb69890e86775d178452880ea0d24384c5ccedf before 552475d0b6cece73a52c0fa5faa0ce45e99df74b; 75cba72ddb788a5b9c7ed2139fbb84383df029eb builds before 8ee8ccfd60bf17cbdab91069d324b5302f4f3a30; from ae4747dab2eab95a68bb2f6c7e904bff0424e1b1 before c9e594194795c86ca753ad6ed64c2762e9309d0d; from c4c54fce9ec54a59a4ca035af13c2823c76684cc before d6f0d586808689963e58fd739bed626ff5013b24; from fed93fb62e05c38152b0fc1dc9609639e63eed76 before c0a0ded3bb7fd45f720faa48449a930153257d3a; from fed93fb62e05c38152b0fc1dc9609639e63eed76 before e69a7b0a71b6561b3b6459f1fded8d589f2e8ac2; from fed93fb62e05c38152b0fc1dc9609639e63eed76 before 49c57c6c108931a914ed94e3c0ddb974008260a3; from fed93fb62e05c38152b0fc1dc9609639e63eed76 before b505047ffc8057555900d2d3a005d033e6967382; and 10 more ranges	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V4.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.19.306 before 4.20; from 5.4.268 before 5.5; from 5.10.209 before 5.10.251; from 5.15.148 before 5.15.201; from 6.1.75 before 6.1.164; from 6.6.14 before 6.6.125; from 6.7.2 before 6.12.72; from 6.13 before 6.18.11; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/552475d0b6cece73a52c0fa5faa0ce45e99df74b	patch
https://git.kernel.org/stable/c/8ee8ccfd60bf17cbdab91069d324b5302f4f3a30	patch
https://git.kernel.org/stable/c/c9e594194795c86ca753ad6ed64c2762e9309d0d	patch
https://git.kernel.org/stable/c/d6f0d586808689963e58fd739bed626ff5013b24	patch
https://git.kernel.org/stable/c/c0a0ded3bb7fd45f720faa48449a930153257d3a	patch
https://git.kernel.org/stable/c/e69a7b0a71b6561b3b6459f1fded8d589f2e8ac2	patch
https://git.kernel.org/stable/c/49c57c6c108931a914ed94e3c0ddb974008260a3	patch
https://git.kernel.org/stable/c/b505047ffc8057555900d2d3a005d033e6967382	patch
https://cert-portal.siemens.com/productcert/html/ssa-253495.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.