CVE-2026-97994
CVE CVE-2026-97994EUVD EUVD-2026-86648Published 2026-09-25T10:23:25.000Z
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRING_NUM larger than device max vhost_vring_set_num() accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to set_vq_num() without comparing it with get_vq_num_max(). A process with access to /dev/vhost-vdpa-* can therefore configure a queue larger than the device advertises. With vdpa_sim, the worker can walk descriptors beyond the mapped descriptor ring. KASAN reports a 16-byte out-of-bounds read, corresponding to one vring_desc, in the vringh IOTLB path: BUG: KASAN: out-of-bounds in _copy_from_iter Read of size 16 copy_from_iotlb copydesc_iotlb vringh_getdesc_iotlb vdpasim_net_work Cache get_vq_num_max() immediately after reset. Some backends derive it from writable queue-size state, so querying it after SET_NUM may return the current size instead of the device capability. Invalidate the cached value before reset so a failed reset leaves SET_NUM disabled. For VHOST_SET_VRING_NUM, copy the complete vring state once and use the same index and size for validation, vq->num, and set_vq_num(). This ensures that validation and use operate on the same copied values.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux 4c8cf31885f69e86be0b5b9e6677a26797365e1d <68232102f20fc961327fb9e0f605a7eaadf030a9; 4c8cf31885f69e86be0b5b9e6677a26797365e1d <1d09201d81b7d3e276860cc7b7dbf6c6cbe8e9b4; 4c8cf31885f69e86be0b5b9e6677a26797365e1d <59522639a7d71cff4e20d594d0b9ea30dd0c77e0; patch: 7.2.7; patch: 0; patch: 7.3-rc3; patch: 6.18.53; 5.7; patch: 6.12.111; 4c8cf31885f69e86be0b5b9e6677a26797365e1d <ccb1dc7c527f8c925925cf92afc76ae590dac311
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.