CVE-2026-97994

Received Received - Intake

Buffer Overflow in Linux Kernel vhost-vdpa Driver

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRING_NUM larger than device max vhost_vring_set_num() accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to set_vq_num() without comparing it with get_vq_num_max(). A process with access to /dev/vhost-vdpa-* can therefore configure a queue larger than the device advertises. With vdpa_sim, the worker can walk descriptors beyond the mapped descriptor ring. KASAN reports a 16-byte out-of-bounds read, corresponding to one vring_desc, in the vringh IOTLB path: BUG: KASAN: out-of-bounds in _copy_from_iter Read of size 16 copy_from_iotlb copydesc_iotlb vringh_getdesc_iotlb vdpasim_net_work Cache get_vq_num_max() immediately after reset. Some backends derive it from writable queue-size state, so querying it after SET_NUM may return the current size instead of the device capability. Invalidate the cached value before reset so a failed reset leaves SET_NUM disabled. For VHOST_SET_VRING_NUM, copy the complete vring state once and use the same index and size for validation, vq->num, and set_vq_num(). This ensures that validation and use operate on the same copied values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97994

EUVD

EUVD-2026-86648

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel allows a process with access to /dev/vhost-vdpa-* to configure a virtual queue larger than what the device supports. The vhost_vring_set_num() function accepts any non-zero power-of-two queue size within 16 bits without validating it against the device's maximum queue size. This can lead to out-of-bounds memory access when the device processes descriptors.

Detection Guidance

This vulnerability is specific to the Linux kernel's vhost/vdpa subsystem and requires local access to /dev/vhost-vdpa-* devices. Detection involves checking kernel logs for KASAN out-of-bounds errors or examining vhost-vdpa device configurations. No network-based detection commands are applicable.

Impact Analysis

An attacker with access to /dev/vhost-vdpa-* could exploit this to cause a kernel memory corruption issue, potentially leading to system crashes or unauthorized memory access. In the case of vdpa_sim, this could allow reading beyond the allocated descriptor ring, triggering a KASAN-reported out-of-bounds read.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue with no documented impact on data protection or privacy requirements. The out-of-bounds read occurs in a virtualization component and does not involve unauthorized data access or processing.

Mitigation Strategies

Apply the latest Linux kernel patches that fix this issue. Restrict access to /dev/vhost-vdpa-* devices to trusted users only. Monitor kernel logs for vhost-vdpa related errors. If using vdpa_sim, ensure queue sizes do not exceed device capabilities.

Hi! I’m here to help you understand CVE-2026-97994. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70