Executive brief
A vulnerability was identified in the Linux kernel's vhost component, which is responsible for high-performance data exchange between virtual machines and the host system. A logic error in how the system handles data transfers could allow a local attacker to cause system instability or potentially gain unauthorized access to sensitive information. This issue primarily affects environments running virtualized workloads on Linux hosts.
Technical details
A vulnerability exists in 'drivers/vhost/vringh.c' within the Linux kernel due to improper return value validation of 'copy_from_iter' and 'copy_to_iter'. These functions return a 'size_t' representing the number of bytes copied, which is always non-negative; however, the code previously checked if the return value was less than zero to detect errors. This logic error allowed partial or failed copies to proceed as if they were successful, potentially leading to memory corruption or information disclosure. The fix modifies the check to ensure the returned size exactly matches the expected 'translated' length, returning '-EFAULT' otherwise. This is reachable via local attackers with access to vhost interfaces.
Affected products
- Linux Linux Kernel 6.0 to 6.1.156, 6.6.112, 6.12.53, 6.17.3
Timeline
- 2025-10-28: disclosed
- 2025-10-28: advisory
- 2025-10-15: patched: Patched in various stable branches including 6.1.y, 6.6.y, and 6.12.y
References
- https://git.kernel.org/stable/c/78dc7362662fedaa1928fb8e4f27401c8322905d
- https://git.kernel.org/stable/c/82a8d0fda55b35361ee7f35b54fa2b66d7847d2b
- https://git.kernel.org/stable/c/baa37b1c7e29546f79c39bef0d18c4edc9f39bb1
- https://git.kernel.org/stable/c/cfa0654402c06d086201a9ff167eb95da5844fc3
- https://git.kernel.org/stable/c/db042925a5ab7a550b710addeadbf6f72e3a8a4b