Red Hat Enterprise Linux 10 CVE-2026-5164

CVSS 6.7 is moderately elevated but the real-world risk is constrained by authentication and privilege requirements. The CVSS vector shows AV:L (local attack only), AC:L (low complexity), and critically PR:H (requires high-privilege user), which substantially reduces exploitability in multi-tenant or least-privilege environments. EPSS data is not provided, but the combination of local-only attack vector and high-privilege requirement suggests lower exploitation probability than a remote or low-privilege vulnerability despite the buffer overflow nature. No KEV status is indicated, implying no confirmed active exploitation at time of analysis. The existence of a GitHub PR fix (reference [3]) indicates the vulnerability was reported through responsible disclosure. Primary risk applies to systems where unprivileged users can be compromised or where high-privilege user accounts are less tightly controlled. The DoS-only impact (no code execution despite buffer overflow) limits the damage even if exploited.

A local user with high-privilege (such as a domain administrator or system operator in a corporate virtualized environment) on a RHEL guest system invokes a crafted sequence of virtio device unmap operations with an artificially inflated descriptor count that exceeds the RhelDoUnMap() function's internal buffer allocation. This triggers a buffer overrun that crashes the driver or kernel subsystem, rendering the guest operating system unavailable. No public exploit code has been identified, and active exploitation is not confirmed; the attack requires direct local access and high privilege, limiting opportunistic exploitation.