Executive brief
Zephyr's virtio driver, which enables communication with virtualized peripheral devices in embedded systems, fails to validate descriptor IDs provided by a virtio backend device. A malicious hypervisor or compromised device can supply an out-of-bounds ID that causes the driver to call an arbitrary function pointer with attacker-controlled arguments, leading to code execution or system crash. This affects embedded systems using Zephyr with virtio over PCI or MMIO transports.
Technical details
The vulnerability is an out-of-bounds memory access (CWE-125) in the virtio_isr() function (drivers/virtio/virtio_common.c). The driver reads a descriptor-chain head ID from the device-written used ring without validating it is less than vq->num, then uses this ID directly to index recv_cbs[] and desc[] arrays, both allocated with exactly vq->num entries. The indexed callback function pointer is then invoked in interrupt context. A malicious or compromised virtio backend (untrusted hypervisor, compromised hardware device, or peer processor on PCI/MMIO) can supply an out-of-range ID to trigger an arbitrary heap read and subsequent function pointer dereference. No guest privileges or user interaction are required; the backend simply writes to the shared used ring and raises an interrupt. The fix adds a bounds check rejecting any descriptor id >= vq->num before invoking the callback. This affects all builds using CONFIG_VIRTIO with PCI or MMIO transport enabled.
Affected products
- Zephyr Zephyr RTOS versions prior to fix commit fe47dbc (2026-08-24)
Timeline
- 2026-08-24: disclosed: Published to NVD
- 2026-08-24: patched: Fix committed as fe47dbca080957c425383cc1d5bdc7d48a41d4a5