CVE-2026-13216: Zephyr virtio PCI driver stack buffer overflow in capability parsing

CVE-2026-13216 · Severity: medium · CVSS 6.1 · Published 2026-08-25

The Zephyr kernel's virtio PCI driver improperly validates the size of device capability data during initialization. A malicious or compromised virtio device can write attacker-controlled data beyond buffer boundaries on the kernel stack, risking system crash or code execution. This affects bare-metal systems with untrusted virtio devices or confidential computing environments where the guest must defend against the hypervisor host.

Technologies: Zephyr Project Zephyr OS. Vendors: Zephyr Project.

Quick answers

Is CVE-2026-13216 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13216 being exploited in the wild.
How severe is CVE-2026-13216?
Medium severity, with a CVSS score of 6.1, published 25 August 2026.
Which products and versions are affected?
Zephyr Project Zephyr OS <UNKNOWN>.
Is there a fix for CVE-2026-13216?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13216 attacked?
It is attacked over the network or with local access or from the adjacent network, in an operating system.
Am I affected by CVE-2026-13216?
Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stack-based buffer overflow in virtio_pci_read_cap() (drivers/virtio/virtio_pci.c). The driver reads a device-supplied capability length byte (cap_len) from PCI configuration space without proper validation—the existing assert() is compiled out by default (CONFIG_ASSERT off in production). The unvalidated cap_len value then drives a loop copying capability data into a fixed-size stack buffer. Underflow of the unsigned extra_data_words count enables near-unbounded writes; overflow allows up to ~228 bytes of device-controlled data to be written past the buffer. The attack requires a malicious or untrusted virtio PCIe device accessible to the kernel during probe time. The fix implements a runtime range check before arithmetic, rejecting cap_len outside the valid bounds.

Affected products

  • Zephyr Project Zephyr OS <UNKNOWN>

Timeline

  • 2026-08-25: disclosed
  • 2026-08-25: advisory: CVE-2026-13216

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.