EUVD-2026-17111
GHSA-6457-73j6-h3qg
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in virtio-win. The RhelDoUnMap() function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).
AnalysisAI
Buffer overflow in virtio-win's RhelDoUnMap() function allows local privileged users to trigger a denial of service by supplying an excessive number of descriptors during unmap operations, causing system crashes. Affects Red Hat Enterprise Linux 8, 9, and 10 across multiple architectures. The vulnerability requires high-level privilege (PR:H) but offers no confidentiality or integrity protections beyond the immediate DoS impact, with a CVSS score of 6.7 reflecting the local attack requirement and high-privilege barrier.
Technical ContextAI
Virtio-win is a Windows guest driver package for KVM/QEMU virtualization environments that implements paravirtualized I/O devices using the Virtio protocol. The RhelDoUnMap() function is responsible for handling descriptor unmapping requests, which are part of the Virtio device communication protocol. The vulnerability stems from insufficient bounds checking (CWE-120: Buffer Copy without Checking Size of Input) on user-supplied descriptor counts, allowing an attacker to write beyond allocated buffer boundaries. The affected CPE identifiers indicate this impacts RHEL systems running virtio-win drivers across versions 8, 9, and 10.
RemediationAI
Obtain and install the patched version of virtio-win released by Red Hat for RHEL 8, 9, and 10 as detailed in the official security advisory at https://access.redhat.com/security/cve/CVE-2026-5164. The upstream fix is available in GitHub PR #1504 at https://github.com/virtio-win/kvm-guest-drivers-windows/pull/1504; confirm that your RHEL distribution includes the corresponding patched driver version before deployment. As an interim mitigation, restrict high-privilege user account access on virtualized systems and monitor for unmap request anomalies in virtio-win driver logs. Apply the patch during the next scheduled maintenance window, as the local attack requirement and privilege barrier provide some time for planning.
More in Red Hat Enterprise Linux 10
View allRemote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today