# CVE-2026-13216: Zephyr virtio PCI driver stack buffer overflow in capability parsing

Source: https://junglewise.ai/threats/cve-2026-13216-zephyr-virtio-pci-driver-stack-buffer-overflow-in-capability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-13216 · Severity: medium · CVSS 6.1 · Published 2026-08-25

The Zephyr kernel's virtio PCI driver improperly validates the size of device capability data during initialization. A malicious or compromised virtio device can write attacker-controlled data beyond buffer boundaries on the kernel stack, risking system crash or code execution. This affects bare-metal systems with untrusted virtio devices or confidential computing environments where the guest must defend against the hypervisor host.

Technologies: [Zephyr Project Zephyr OS](https://junglewise.ai/threats/technologies/zephyr-os). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-13216 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13216 being exploited in the wild.

**How severe is CVE-2026-13216?** Medium severity, with a CVSS score of 6.1, published 25 August 2026.

**Which products and versions are affected?** Zephyr Project Zephyr OS <UNKNOWN>.

**Is there a fix for CVE-2026-13216?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13216 attacked?** It is attacked over the network or with local access or from the adjacent network, in an operating system.

**Am I affected by CVE-2026-13216?** Check whether you run Zephyr Project Zephyr OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stack-based buffer overflow in virtio_pci_read_cap() (drivers/virtio/virtio_pci.c). The driver reads a device-supplied capability length byte (cap_len) from PCI configuration space without proper validation—the existing assert() is compiled out by default (CONFIG_ASSERT off in production). The unvalidated cap_len value then drives a loop copying capability data into a fixed-size stack buffer. Underflow of the unsigned extra_data_words count enables near-unbounded writes; overflow allows up to ~228 bytes of device-controlled data to be written past the buffer. The attack requires a malicious or untrusted virtio PCIe device accessible to the kernel during probe time. The fix implements a runtime range check before arithmetic, rejecting cap_len outside the valid bounds.

## Affected products

- Zephyr Project Zephyr OS <UNKNOWN>

## Timeline

- 2026-08-25: disclosed
- 2026-08-25: advisory: CVE-2026-13216

## Related threats

- [Zephyr MCTP over USB use-after-free in packet buffer handling](https://junglewise.ai/threats/cve-2026-85032-the-mctp-over-usb-device-class-in-subsys-pmci-mctp-mctp-usb-c)
- [Zephyr arm64 MMU TLB invalidation memory isolation bypass](https://junglewise.ai/threats/cve-2026-79979-the-arm64-mmu-backend-invalidates-a-single-virtual-address-from)
- [Zephyr UpdateHub firmware client NULL pointer dereference in CoAP probe parsing](https://junglewise.ai/threats/cve-2026-76787-the-updatehub-firmware-over-the-air-client-parses-the-coap-probe)
- [CC1200 sub-GHz IEEE 802.15.4 driver buffer overflow in RX packet parsing](https://junglewise.ai/threats/cve-2026-75084-the-cc1200-sub-ghz-ieee-802-15-4-driver-takes-the-phy-packet)
- [Zephyr Bluetooth Link Layer memory leak in connection update](https://junglewise.ai/threats/cve-2026-19739-the-bluetooth-link-layer-control-procedure-code-in-subsys)