Kernel compromise via wrong admin-queue cleanup pointer

Memory corruption in Linux 6.11 through 6.11.8 allows attackers controlling a virtio PCI device to compromise or crash the kernel. During reset or teardown with the admin-queue feature negotiated, cleanup indexes vp_dev->vqs[] with the device-selected queue index instead of using vp_dev->admin_vq.info, then dereferences the resulting pointer. Automatic driver binding requires no guest credentials; the out-of-bounds pointer can expose or corrupt kernel heap memory and can produce a kernel panic.