Executive brief
The Zephyr kernel's virtio PCI driver improperly validates the size of device capability data during initialization. A malicious or compromised virtio device can write attacker-controlled data beyond buffer boundaries on the kernel stack, risking system crash or code execution. This affects bare-metal systems with untrusted virtio devices or confidential computing environments where the guest must defend against the hypervisor host.
Technical details
The vulnerability is a stack-based buffer overflow in virtio_pci_read_cap() (drivers/virtio/virtio_pci.c). The driver reads a device-supplied capability length byte (cap_len) from PCI configuration space without proper validation—the existing assert() is compiled out by default (CONFIG_ASSERT off in production). The unvalidated cap_len value then drives a loop copying capability data into a fixed-size stack buffer. Underflow of the unsigned extra_data_words count enables near-unbounded writes; overflow allows up to ~228 bytes of device-controlled data to be written past the buffer. The attack requires a malicious or untrusted virtio PCIe device accessible to the kernel during probe time. The fix implements a runtime range check before arithmetic, rejecting cap_len outside the valid bounds.
Affected products
- Zephyr Project Zephyr OS <UNKNOWN>
Timeline
- 2026-08-25: disclosed
- 2026-08-25: advisory: CVE-2026-13216