Executive brief
The Linux kernel's vhost/vdpa subsystem is used to implement virtual device backends for virtualization workloads. A validation flaw in the memory-mapping and fault-handling paths allows an attacker to pass an out-of-bounds virtqueue index to device-specific callbacks, potentially leading to invalid memory access, system crashes, or denial of service.
Technical details
This vulnerability is a bounds-checking bypass in the vhost/vdpa driver (drivers/vhost/vdpa.c). The vhost_vdpa_mmap() and vhost_vdpa_fault() functions use vma->vm_pgoff as a virtqueue index without validating it against v->nvqs (the actual number of queues). While the ioctl code path performs both bounds checking and array_index_nospec() mitigation, the mmap/fault paths only checked that the index fits in u16, allowing out-of-range indices to reach driver-specific get_vq_notification() callbacks. An attacker with ability to trigger mmap or fault operations can supply an invalid queue index, leading to out-of-bounds access in the callback, invalid PFN remaps, and potential system crash or DoS. The fix consolidates validation into a unified vhost_vdpa_get_vq_notification() helper that validates against v->nvqs and applies array_index_nospec() before invoking the driver callback.
Affected products
- Linux Linux kernel All versions with vhost/vdpa support (introduced in kernel 5.17 or earlier; patched in 2026-07-24)
Timeline
- 2026-08-15: disclosed: NVD publication
- 2026-07-24: patched: Kernel stable releases (commit 0f310bac6db9bd3bb1655707d692d9d2a86eeb17)
- 2026-05-08: other: Upstream commit 929e4f044621c8cc30b612fb74e1410bef09e41b authored