Executive brief
The Linux kernel's vhost subsystem caches virtual I/O ring metadata addresses for performance. When vring configuration changes through specific ioctl commands, this cache is not properly reset, allowing stale address mappings to remain. An attacker with access to configure vhost devices could exploit this to read or write memory outside intended regions, potentially compromising system stability or enabling privilege escalation on virtualized systems.
Technical details
The vulnerability exists in the vhost subsystem's metadata IOTLB cache (vq->meta_iotlb[]). This cache stores virtual-to-physical address mappings for vring regions to optimize subsequent access checks. The cache is normally reset on IOTLB updates and device reinitialization, but fails to reset when VHOST_SET_VRING_ADDR or VHOST_SET_VRING_NUM ioctls reconfigure the vring addresses or region sizes. When a device IOTLB is attached, these ioctls bypass immediate address validation, deferring checks to runtime. With stale cache entries, iotlb_access_ok() returns true on cache hits without re-validating, causing subsequent memory operations via vhost_copy_to_user() and vhost_copy_from_user() to access memory outside the IOTLB's mapped region. The fix resets the metadata cache during vring reconfiguration to force re-validation through the slow path. Local privilege with vhost device access is required.
Affected products
- Linux Linux kernel affected versions prior to fix
Timeline
- 2026-08-21: published
- 2026-08-21: disclosed