EUVD-2026-64400
GHSA-5mqx-jw5r-hp6c
Severity by source
AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Requires vhost device access (at minimum a local userspace or guest process), so PR:L is more accurate than PR:N; scope change retained for host availability impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
vhost_iotlb: bound map allocation in add_range
vhost_iotlb_add_range_ctx() only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating entries after reaching their configured limit.
Existing vhost devices allocate their IOTLB with max_iotlb_entries from vhost.c, which defaults to 2048 and is tunable by module parameter. Use the caller-provided limit at the allocation point instead of adding a separate default in the common IOTLB helper, and reject non-positive values in vhost paths that can report an error.
Other vhost IOTLB users should not create zero-limit tables when entries can be populated from userspace or guest-controlled requests. Add caller-side max_iotlb_entries parameters for mlx5 vDPA, VDUSE and vhost-vDPA. Reject non-positive VDUSE and vhost-vDPA values, and require at least two entries for vdpa_sim and mlx5 vDPA paths that install full-range mappings, since those mappings are split into two IOTLB entries.
Handle full-range mappings in the common helper by checking that the IOTLB can hold both split entries before inserting the first half. This avoids returning an error after leaving a half mapping behind.
When the table is full, keep the existing retire behavior for retiring tables and return -ENOSPC for non-retiring tables. Reuse the retired map node instead of freeing it and allocating a replacement, so a stream of IOTLB updates cannot keep forcing GFP_ATOMIC allocations after the table has reached its limit. If a zero-limit IOTLB still reaches the common helper, treat it as a configuration error and return -EINVAL.
I found this bug myself, though the patch was written with AI assistance.
AnalysisAI
Unbounded memory allocation in the Linux kernel's vhost_iotlb subsystem allows availability impact on the host system via exhaustion of kernel memory. The flaw exists in vhost_iotlb_add_range_ctx(), where non-retiring IOTLB tables bypass the configured entry limit and continue allocating entries indefinitely - including via guest-controlled or userspace requests to vhost, mlx5 vDPA, VDUSE, and vhost-vDPA subsystems. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Linux system to be running one of the affected vhost subsystems (vhost, mlx5 vDPA, VDUSE, or vhost-vDPA) with an active IOTLB table that does not have VHOST_IOTLB_FLAG_RETIRE set (a non-retiring table). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 7.1 (High) with vector AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects that a guest-level actor (who holds no host privileges) can trigger the flaw locally, causing availability impact that crosses into the host kernel scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A malicious or compromised guest VM operating on a Linux host using vhost-vDPA or VDUSE continuously submits IOTLB mapping requests that populate a non-retiring IOTLB table beyond its configured limit. Because the retirement gate is never triggered, the kernel performs unbounded GFP_ATOMIC allocations, progressively exhausting the host kernel's memory pool. … |
| Remediation | Vendor-released patch: Linux 7.1.9 (stable) and Linux 7.2 (mainline). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all production systems running vulnerable Linux kernel versions hosting virtualized workloads (check for vhost module presence via lsmod | grep vhost). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today