Vhost vdpa Group Validation Bypass in Linux Kernel

Publication date: 2026-05-06

Last updated on: 2026-05-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in vdpa_sim where a valid ASID can be assigned to a group equal to ngroups, causing an out of bound write.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-06

Last Modified

2026-05-11

Generated

2026-07-06

AI Q&A

2026-05-06

EPSS Evaluated

2026-07-05

NVD

CVE-2026-43248

EUVD

EUVD-2026-27809

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.16 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.6 (exc)
linux	linux_kernel	From 5.19 (inc) to 6.12.75 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the vhost subsystem, specifically related to the vdpa (vhost data path acceleration) group bound checks. The issue was that the bound checks were duplicated and not consolidated, increasing the risk that a parent driver might miss them. Additionally, there was a bug in vdpa_sim where a valid ASID (Address Space ID) could be assigned to a group equal to the number of groups (ngroups), which caused an out-of-bounds write.

Impact Analysis

The vulnerability can lead to an out-of-bounds write in the Linux kernel's vhost subsystem. This type of memory corruption can potentially cause system instability, crashes, or be exploited to execute arbitrary code with kernel privileges, depending on the context and exploitability.

Hi! I’m here to help you understand CVE-2026-43248. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70