Linux Kernel CVE-2026-43248

Exploitation requires local authenticated access to a Linux system (PR:L in CVSS vector) with vDPA functionality enabled and accessible to the attacker's privilege level. Specifically requires kernel built with CONFIG_VHOST_VDPA and CONFIG_VDPA_SIM enabled, vhost_vdpa and vdpa_sim kernel modules loaded, and user permissions to interact with /dev/vhost-vdpa device nodes (typically requires membership in kvm, libvirt, or qemu groups, or CAP_NET_ADMIN capability). Vulnerable code path is triggered during VM or virtio device provisioning operations that invoke vDPA group assignment with ASID values. Systems not using vDPA hardware acceleration for virtualization or lacking loaded vhost_vdpa modules are not exploitable. Default configurations on non-virtualization servers typically do not load these modules, limiting exposure. Containers with device passthrough capabilities or nested virtualization environments increase attack surface. Remote exploitation is not possible (AV:L) - attacker must first gain shell access through other means.

CVSS 7.8 High severity reflects local attack vector requiring authenticated access with potential for complete confidentiality, integrity, and availability compromise in kernel space. However, multiple mitigating factors reduce practical risk: (1) Local access prerequisite limits attack surface to users with existing system access or chained exploitation scenarios. (2) PR:L indicates low-privileged user capability, but exploitation requires specific vDPA device interaction privileges, which are not universally available. (3) EPSS 0.02% (5th percentile) suggests security researchers and attackers assess this as low-priority for exploitation despite high CVSS. (4) No CISA KEV listing and no public POC identified indicate theoretical rather than actively exploited threat. (5) Vendor patches available across all maintained stable branches (6.12.75, 6.18.16, 6.19.6, 7.0) provide clear remediation path. Real-world risk is moderate: organizations using virtualization environments with vDPA-capable hardware and untrusted local users should prioritize patching, while systems without vDPA configurations or untrusted local access face minimal immediate risk. The information disclosure tag suggests potential memory leak vectors beyond the primary OOB write impact.

A low-privileged local user with access to vDPA-enabled virtualization infrastructure initiates VM creation or modification operations that trigger vhost_vdpa ASID group assignment. By crafting specific virtio device configuration parameters that request a group index equal to the maximum ngroups value, the attacker triggers the bounds check failure in vdpa_sim. The resulting out-of-bounds write corrupts adjacent kernel memory structures, potentially overwriting function pointers or security credentials. The attacker leverages this memory corruption to escalate privileges to root or execute arbitrary code in kernel context, achieving full system compromise. No public POC exists, but the fix commits in stable branches confirm the technical feasibility of this attack path.