Executive brief
A vulnerability in the Linux kernel's Hyper-V video driver could allow a host system to send malformed messages that cause the guest system to read or write beyond its intended memory buffers. This component is responsible for managing synthetic video displays in virtualized environments. An exploit could lead to the exposure of sensitive memory contents or cause the guest operating system to crash, impacting system stability and data privacy.
Technical details
A vulnerability exists in the hyperv_receive_sub() function within the Linux kernel's DRM driver for Hyper-V. The function dispatches message types based on the vid_hdr.type field without verifying the actual number of bytes received (bytes_recvd). This allows a malicious or malformed host to trigger a memcpy() of VMBUS_MAX_PACKET_SIZE (16 KiB) into hv->init_buf even if the actual message was smaller, potentially leaking residue from previous messages. Additionally, when vmbus_recvpacket() returns -ENOBUFS, the reported required length could exceed the 16 KiB buffer size, leading to an out-of-bounds read/write if not properly gated. The fix introduces strict validation of packet sizes against expected header and payload lengths for each message type.
Affected products
- Linux Linux kernel 5.14+
Timeline
- 2026-05-23: other: Patch authored
- 2026-06-09: patched: Patch committed to stable tree
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/049a6b474823049fe60212f25f26e4b30f44ee8f
- https://git.kernel.org/stable/c/164dc7bf17609340233c6bf4f66bb7c7008a0511
- https://git.kernel.org/stable/c/57d5d697642e05d5dd2d40660817765943dd709f
- https://git.kernel.org/stable/c/588c84b461393ff1998ac7b97b04f953f642e0df
- https://git.kernel.org/stable/c/7f87763f47a3c22fb50265a00619ef10f2394b18
- https://git.kernel.org/stable/c/c8974d96b6a5496f33dc69a3ce28a7bf5078def4
- https://git.kernel.org/stable/c/f5251226551bfec98c4705641b6f94ff1f238d91