Skip to main content

Linux Kernel virtio-gpu CVE-2026-3886

MEDIUM
2026-07-09 vendor:ubuntu
Buffer Overflow Suse
Share

Severity by source

vuln.today AI
7.8 HIGH

Local vector as virtio-gpu is only accessible from within a guest VM; PR:L because device node access requires group membership or equivalent low privilege.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Lifecycle Timeline

1
Analysis Generated
Jul 09, 2026 - 19:48 vuln.today

DescriptionCVE.org

[virtio-gpu: fix overflow check when allocating 2d image]

AnalysisAI

Integer overflow in the virtio-gpu driver's 2D image allocation path of the Linux kernel exposes virtualized guest systems to potential heap corruption. The flaw resides in an insufficient overflow check performed before allocating memory for a 2D image resource in the virtio-gpu paravirtualized GPU subsystem. An attacker or malicious process with access to GPU resource creation within an affected guest OS could trigger the overflow, potentially leading to out-of-bounds memory writes and kernel-level memory corruption. No public exploit or KEV listing is identified at time of analysis.

Technical ContextAI

The virtio-gpu driver is a paravirtualized GPU driver present in the Linux kernel, designed to communicate with the QEMU virtio-gpu device emulator in KVM/QEMU virtualized environments. It enables guest operating systems to submit rendering commands and allocate GPU resources. The specific flaw is in the integer arithmetic used to validate or compute the allocation size for a 2D image resource: the overflow check itself is flawed, meaning an attacker-controlled width, height, or format field could produce a wrapped (smaller) size that passes the check but results in an undersized heap allocation. This is consistent with CWE-190 (Integer Overflow or Wraparound) or CWE-131 (Incorrect Calculation of Buffer Size), though no CWE is formally assigned in the available data. CPE data is not provided; affected kernel versions must be confirmed via the Ubuntu security advisory.

Affected ProductsAI

The affected product is the Linux kernel's virtio-gpu driver. Exact affected kernel versions are not confirmed from the available data; Ubuntu has reported this vulnerability (vendor:ubuntu), suggesting that Ubuntu-shipped kernel packages are affected. Users should consult the Ubuntu Security Notices (USN) portal for the specific package versions impacted. No CPE strings were provided in the intelligence data.

RemediationAI

Apply the kernel patch addressing the overflow check in the virtio-gpu 2D image allocation path. Ubuntu-specific fixed packages should be obtained via Ubuntu Security Notices; run 'apt-get update && apt-get upgrade linux-image-*' on affected Ubuntu systems and reboot to load the patched kernel. No exact fixed version is confirmed from the available data - consult the Ubuntu vendor advisory for the specific patched kernel version. As a compensating control where patching is not immediately possible, consider restricting unprivileged access to the virtio-gpu DRM device node (e.g., tightening /dev/dri/* permissions or removing untrusted users from the 'video' or 'render' group), accepting the trade-off of broken GPU acceleration for those users. In multi-tenant VM environments, ensuring guests run with the minimum required privileges reduces the blast radius if exploitation occurs.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed

Share

CVE-2026-3886 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy