vhost/vdpa: reject VRING_NUM larger than device max
In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRING_NUM larger than device max vhost_vring_set_num() accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to set_vq_num() without comparing it with get_vq_num_max(). A process with access to /dev/vhost-vdpa-* can therefore configure a queue larger than the device advertises. With vdpa_sim, the worker can walk descriptors beyond the mapped descriptor ring. KASAN reports a 16-byte out-of-bounds read, corresponding to one vring_desc, in the vringh IOTLB path: BUG: KASAN: out-of-bounds in _copy_from_iter Read of size 16 copy_from_iotlb copydesc_iotlb vringh_getdesc_iotlb vdpasim_net_work Cache get_vq_num_max() immediately after reset. Some backends derive it from writable queue-size state, so querying it after SET_NUM may return the current size instead of the device capability. Invalidate the cached value before reset so a failed reset leaves SET_NUM disabled. For VHOST_SET_VRING_NUM, copy the complete vring state once and use the same index and size for validation, vq->num, and set_vq_num(). This ensures that validation and use operate on the same copied values.
CVE-2026-97994
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-97994
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4c8cf31885f69e86be0b5b9e6677a26797365e1d",
"lessThan": "4875c65ca53797a0a402fe2bb54d1b12f28b3cda",
"versionType": "git"
},
{
"status": "affected",
"version": "4c8cf31885f69e86be0b5b9e6677a26797365e1d",
"lessThan": "1d09201d81b7d3e276860cc7b7dbf6c6cbe8e9b4",
"versionType": "git"
},
{
"status": "affected",
"version": "4c8cf31885f69e86be0b5b9e6677a26797365e1d",
"lessThan": "68232102f20fc961327fb9e0f605a7eaadf030a9",
"versionType": "git"
},
{
"status": "affected",
"version": "4c8cf31885f69e86be0b5b9e6677a26797365e1d",
"lessThan": "59522639a7d71cff4e20d594d0b9ea30dd0c77e0",
"versionType": "git"
},
{
"status": "affected",
"version": "4c8cf31885f69e86be0b5b9e6677a26797365e1d",
"lessThan": "ccb1dc7c527f8c925925cf92afc76ae590dac311",
"versionType": "git"
}
],
"programFiles": [
"drivers/vhost/vdpa.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/vhost/vdpa.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-97994
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38124 · Revision 1
- Added to Heist Feed
- Publisher date