CVE-2026-23229 crypto: virtio - Add spinlock protection with virtqueue notification
A race condition in the Linux kernel's virtio-crypto driver can cause system hangs during concurrent cryptographic operations, requiring a patch to add spinlock protection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23229?
CVE-2026-23229 is a medium-severity vulnerability in Linux kernel, published on 18 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: virtio - Add spinlock protection with virtqueue notification
When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes, such as openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32
openssl processes will hangup and there is error reported like this: virtio_crypto virtio0: dataq.0:id 3 is not a head!
It seems that the data virtqueue need protection when it is handled for virtio done notification. If the spinlock protection is added in virtcrypto_done_task(), openssl benchmark with multiple processes works well.
Which versions are affected by CVE-2026-23229?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23229?
Apply the vendor's patch.
Is CVE-2026-23229 being exploited?
There is no known exploitation of CVE-2026-23229 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23229, DEBIAN-CVE-2026-23229, GHSA-j87r-wgfm-7fjj, ROOT-OS-DEBIAN-11-CVE-2026-23229, ROOT-OS-DEBIAN-12-CVE-2026-23229, ROOT-OS-UBUNTU-2204-CVE-2026-23229 and 2 more.