Red Hat Enterprise Linux 10 CVE-2026-5165

The CVSS 6.7 (Medium) score reflects an attack vector of local (not network-accessible) with high privilege requirement (PR:H), meaning only administrators or high-privileged processes can trigger the vulnerability. However, CVSS signals high confidentiality, integrity, and availability impact (C:H, I:H, A:H), indicating that successful exploitation could allow memory corruption, data exfiltration, or system crash. The local + high-privilege constraint significantly reduces real-world attack surface compared to remote or unauthenticated exploits. SSVC considerations: exploitation requires triggering a device reset on a hypervisor-managed virtual device, which is not typically automated and requires hypervisor-level or guest administrator access. The lack of public exploit code and absence of KEV status suggest this is a lower-priority operational risk than remote code execution vulnerabilities, though the impact severity (memory corruption) warrants timely remediation during maintenance windows. Organizations should prioritize patching based on guest OS criticality and administrator trust boundaries.

An authenticated hypervisor administrator or a high-privileged guest OS administrator (e.g., SYSTEM on Windows guest) triggers a VirtIO Block device reset during maintenance or VM reconfiguration. The reset handler dereferences freed memory structures, allowing the attacker to corrupt adjacent kernel allocations or read sensitive data from freed memory regions. Depending on what data occupies the freed memory after reset, this could lead to privilege escalation within the guest or host hypervisor escape if memory layouts align favorably. No public proof-of-concept code is known at time of analysis.