CVE-2026-64456: Linux kernel out-of-bounds read in virtio-rng driver

CVE-2026-64456 · Severity: info · CVSS 0 · Published 2026-07-25

Executive brief

A vulnerability in the Linux kernel's random number generator driver for virtualized environments could allow a malicious or malfunctioning host system to access sensitive data from the guest system's memory. This occurs because the driver fails to properly check the size of data provided by the host, potentially leading to a memory leak or corruption of the guest's random number generation. In practice, this could be used by a cloud provider or hypervisor to bypass security boundaries and read private information from a virtual machine.

Technical details

An out-of-bounds read vulnerability exists in the virtio-rng driver (drivers/char/hw_random/virtio-rng.c) within the copy_data() function. The root cause is that random_recv_done() stores the device-reported 'used.len' directly into 'vi->data_avail' without validation. Subsequent calls to copy_data() use this unvalidated length to perform a memcpy() from the 'vi->data' buffer, allowing a malicious or buggy virtio-rng backend to steer the read operation into adjacent kmalloc slab memory. This can result in the guest kernel mixing sensitive heap data into its entropy pool or exposing it directly to guest root userspace via /dev/hwrng. The fix involves clamping the device-reported length at the point of use and utilizing array_index_nospec() to prevent speculative execution attacks.

CVE-2026-64456: Linux kernel out-of-bounds read in virtio-rng driver

Executive brief

Technical details

Affected products

Timeline

References