Linux Kernel EUVD-2026-86645

Requires the CONFIG_VDPA_SIM_BLK simulator driver to be built and an instantiated vdpa_sim_blk device, plus local low-privilege access to drive virtio-blk requests to it (e.g., via vhost-vdpa). The trigger is a request whose start sector is at or beyond the device capacity, or a sub-sector request exactly at the capacity boundary. Limiting factors: this is a development/simulation driver rarely enabled in production kernels, exploitation is local (AV:L) and needs existing privilege over the device (PR:L), and reliably converting the huge underflowed offset into a controlled adjacent-buffer corruption (rather than an unusable wild pointer that just crashes) requires the specific boundary condition described (AC:H).

This is a genuine memory-safety flaw with a controlled component, not the DoS-only pattern common to this kernel batch. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H = 7.8) reflects local access with existing low privilege over the vDPA device, and the S:C (scope change) is defensible: vdpa_sim_blk runs in host kernel context while requests are driven by a guest/consumer via vhost-vdpa, so guest-controlled input corrupting host memory crosses a security boundary. The impact ratings are supported by the description - VIRTIO_BLK_T_OUT copies guest-controlled data out of bounds (integrity), VIRTIO_BLK_T_IN reads host memory back to the guest (confidentiality/leak), and any wild offset faults (availability). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or imminent exploitation. The dominant risk-limiting factor is deployment: vdpa_sim_blk is a simulator/development driver, so despite the accurate CVSS, real-world exposure is very narrow. AC:H is plausible because turning the underflow into a useful adjacent-buffer write (rather than an unusable ~2^64 wild offset that merely crashes) requires the specific sub-sector-at-capacity boundary condition described. Net: technically legitimate, correctly tagged, but low operational priority due to rare footprint and absent exploitation signals.

A local principal with access to a vdpa_sim_blk device (or a guest reaching it through vhost-vdpa passthrough) submits a virtio-blk request whose start sector is at or beyond the simulated device capacity. The failed range check logs the error but proceeds, so the unsigned capacity subtraction underflows into an out-of-range offset into blk->buffer, letting a WRITE (T_OUT/T_WRITE_ZEROES) corrupt host memory or a READ (T_IN) leak host memory to the guest. No public exploit code is identified at time of analysis.