EUVD-2026-17113Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in virtio-win, specifically within the VirtIO Block (BLK) device. When the device undergoes a reset, it fails to properly manage memory, resulting in a use-after-free vulnerability. This issue could allow a local attacker to corrupt system memory, potentially leading to system instability or unexpected behavior.
AnalysisAI
VirtIO Block device driver in virtio-win fails to properly release memory during device reset, enabling a use-after-free vulnerability that allows high-privileged local attackers to corrupt kernel memory and cause system instability or denial of service. Affected versions span Red Hat Enterprise Linux 8, 9, and 10; no public exploit code or active exploitation has been identified at time of analysis, though upstream fix is available via GitHub PR.
Technical ContextAI
VirtIO is a standardized interface for efficient I/O virtualization in KVM and other hypervisors. The VirtIO Block (BLK) device driver handles virtual disk operations. The vulnerability resides in the reset code path-when the BLK device is reset (typically during VM lifecycle events or error recovery), the driver fails to properly deallocate or invalidate memory structures associated with pending I/O operations. This violates CWE-825 (Expired Pointer Dereference), where freed memory is accessed after being released, allowing an attacker with high privileges to write or read sensitive kernel state. The issue affects virtio-win's guest driver implementations across multiple Red Hat Enterprise Linux major versions, indicating either a common code base or shared dependency.
RemediationAI
Update virtio-win drivers to a patched version released after GitHub PR #1493 (https://github.com/virtio-win/kvm-guest-drivers-windows/pull/1493) is merged and tagged. Consult Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-5165) for official errata and supported patched versions for RHEL 8, 9, and 10. If immediate patching is not feasible, restrict device reset operations to trusted administrators only and disable unnecessary VirtIO Block device hot-plug/hot-unplug cycles where possible. Verify patch applicability with your guest OS version and re-test virtual disk I/O stability after patching.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Same weakness CWE-825 – Expired Pointer Dereference
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today