EUVD-2026-59459
GHSA-vx5g-7fcv-7h84
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only vector with low privilege required to open vhost-vdpa device; C:H/I:H reflect theoretical kernel OOB impact ceiling though DoS is the most confirmed outcome.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
vhost/vdpa: validate virtqueue index in mmap and fault paths
vhost_vdpa_mmap() and vhost_vdpa_fault() use vma->vm_pgoff as a virtqueue index for get_vq_notification(), but they do not validate that the index is smaller than v->nvqs.
The ioctl path already performs both a bounds check and array_index_nospec(), but the mmap/fault path only checks that the index fits in u16. This allows an out-of-range queue index to reach driver-specific get_vq_notification() callbacks.
Fix this by extracting a unified vhost_vdpa_get_vq_notification() helper that validates the queue index against v->nvqs and applies array_index_nospec() before calling the driver callback. Both the mmap and fault paths use this helper, and the bounds checking is consolidated into a single location.
From source inspection, the most defensible impact is out-of-bounds access in the callback path, potentially leading to invalid PFN remaps and crash/DoS.
AnalysisAI
Out-of-bounds kernel memory access in the Linux kernel vhost/vdpa subsystem allows a local attacker with low privileges to crash the system or trigger invalid physical memory mappings via crafted mmap operations. The vhost_vdpa_mmap() and vhost_vdpa_fault() functions accept a user-controlled virtqueue index from vma->vm_pgoff without validating it against the driver's configured queue count (v->nvqs), while the ioctl path already enforces both a bounds check and array_index_nospec(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a Linux system with the vhost_vdpa kernel module loaded and at least one /dev/vhost-vdpa device node present, which in turn requires vDPA-capable hardware or a vDPA software emulator to be configured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is the vendor-assigned score, but the C:H and I:H ratings are theoretical upper bounds - the bug description itself characterizes crash/DoS as the most defensible impact, and a confirmed privilege escalation or data exfiltration path has not been demonstrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched Linux kernel stable release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5, as documented in EUVD-2026-59459 (https://nvd.nist.gov/vuln/detail/CVE-2026-74312) and the upstream stable commits at git.kernel.org. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Linux systems running the vhost/vdpa subsystem (typically VM hosts) and confirm current kernel versions against vendor advisories for active stable branches. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today