CVE-2026-97991
Received Received - Intake

Buffer Overflow in Linux Kernel vDPA Block Device

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of-range sector starts vdpasim_blk_check_range() logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offset reach the data path. The invalid offset is used by three request paths. VIRTIO_BLK_T_OUT copies guest data to blk->buffer + offset through vringh_iov_pull_iotlb(), causing an out-of-bounds write in _copy_from_iter() or memcpy(). VIRTIO_BLK_T_IN copies from blk->buffer + offset to the guest through vringh_iov_push_iotlb(), causing an out-of-bounds read in _copy_to_iter(). VIRTIO_BLK_T_WRITE_ZEROES passes blk->buffer + offset to memset(), causing an out-of-bounds write. Reject starts at or beyond the capacity before the subtraction. Treat the capacity boundary as invalid because the IN and OUT paths round byte counts down to sectors for validation but later copy the original byte counts. A sub-sector request at the capacity boundary would otherwise still access past the end of the buffer. I found this bug myself, though the patch was written with AI assistance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97991
EUVD
EUVD-2026-86645

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a bounds checking issue in the vdpa_sim_blk driver. When processing block requests, the function vdpasim_blk_check_range() logs an invalid start sector but continues validation. A subsequent subtraction on an unsigned capacity can underflow, allowing an out-of-range buffer offset to reach the data path. This leads to potential out-of-bounds memory access in three request paths: write operations, read operations, and write-zeroes operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's vDPA block device simulation (vdpa_sim_blk). Detection requires checking for kernel logs indicating invalid sector starts in vdpasim_blk_check_range(). Monitor kernel logs for errors related to vDPA block device operations.

Impact Analysis

This vulnerability could allow an attacker with access to a virtual machine using the vdpa_sim_blk driver to perform out-of-bounds memory writes or reads. This may result in data corruption, crashes, or potential privilege escalation within the guest system. Systems relying on virtualized block devices are primarily at risk.

Mitigation Strategies

Apply the kernel patch that rejects out-of-range sector starts in vdpa_sim_blk. Update to a fixed Linux kernel version where this issue is resolved. If immediate patching is not possible, disable the vDPA block device simulation module (vdpa_sim_blk) to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97991. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart