Look up another CVE · open CVE-2026-74312 in the interactive tracker
CVE-2026-74312
vhost/vdpa: validate virtqueue index in mmap and fault paths
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/vhost. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-74312 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
vhost_vdpa_mmap() and vhost_vdpa_fault() use vma->vm_pgoff as a virtqueue index for get_vq_notification(), but they do not validate that the index is smaller than v->nvqs. The ioctl path already performs both a bounds check and array_index_nospec(), but the mmap/fault path only checks that the index fits in u16. This allows an out-of-range queue index to reach driver-specific get_vq_notification() callbacks. Fix this by extracting a unified vhost_vdpa_get_vq_notification() helper that validates the queue index against v->nvqs and applies array_index_nospec() before calling the driver callback. Both the mmap and fault paths use this helper, and the bounds checking is consolidated into a single location. From source inspection, the most defensible impact is out-of-bounds access in the callback path, potentially leading to invalid PFN remaps and crash/DoS.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/vhost/vdpa.c
- What this is
- VIRTIO HOST (VHOST)MAINTAINERS section matched on drivers/vhost/ · kvm@vger.kernel.org · Maintained
- Kernel module
- none to look for. The file would have gone into vhost_vdpa, and Debian does not compile it into that module, so finding vhost_vdpa in lsmod would say nothing about this CVE.
Check it on the machine
grep -wE 'CONFIG_VHOST|CONFIG_VHOST_IOTLB|CONFIG_VHOST_RING|CONFIG_VHOST_VDPA' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 4 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sidn
- n
- not enabled on any flavour - this release does not build the code
- Build switches
- CONFIG_VHOST, CONFIG_VHOST_IOTLB, CONFIG_VHOST_RING, CONFIG_VHOST_VDPA
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 6.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/vhost
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.8 | 5.10.261 | 0f310bac6db9 |
| 5.8 | 5.15.212 | 4bf5a51963ff |
| 5.8 | 6.1.178 | 55a644031e61 |
| 5.8 | 6.6.145 | 2b3f79b90b23 |
| 5.8 | 6.12.97 | bbba4f925152 |
| 5.8 | 6.18.40 | 1f5f94c6c6b2 |
| 5.8 | 7.1.5 | 32ac9097aa24 |
| 5.8 | 7.2 | 929e4f044621 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is reached only via local mmap()/page-fault handling on /dev/vhost-vdpa-N (vma->vm_pgoff selects the virtqueue); there is no network, adjacent-radio, or physical-device path to this code.
- AC:LAttack complexity, low
- Once the device node is open, the attacker fully controls vm_pgoff and can pick any index up to 65535; no race, rare config, or victim-dependent timing is required to hit the out-of-range callback.
- PR:LPrivileges required, low
- vhost_vdpa_open()/mmap() perform no capable() checks; in typical cloud/hypervisor deployments the vhost-vdpa char device is held by an unprivileged VMM/QEMU account (or a compromised QEMU), not init-namespace root.
- UI:NUser interaction, none
- Exploitation requires only the attacker's own open/mmap of the vhost-vdpa device with a crafted pgoff; no separate victim mount, click, or administrative action is needed.
- S:UScope, unchanged
- Impact stays within the host kernel security domain reached through the vhost-vdpa interface; it is not a guest-to-host VM escape or IOMMU-boundary bypass by itself.
- C:HConfidentiality impact, high
- An out-of-range index drives driver get_vq_notification() callbacks (e.g. vp_vdpa/ifcvf/pds/octeon) to read past vring metadata; the returned notify.addr is then used by vmf_insert_pfn(), enabling arbitrary physical-page mapping and kernel memory disclosure.
- I:HIntegrity impact, high
- The mmap mapping is write-only doorbell access; remapping an attacker-chosen physical page via the corrupted notify.addr grants a write primitive to arbitrary physical memory and device MMIO, supporting control-flow or privilege manipulation.
- A:HAvailability impact, high
- Invalid or attacker-influenced PFN insertion during fault handling can BUG/oops the kernel immediately; even without full exploitation, the out-of-bounds callback access provides a reliable host crash/DoS vector.