CVE-2025-40051

In the Linux kernel, the following vulnerability has been resolved:

vhost: vringh: Modify the return value check

The return value of copy_from_iter and copy_to_iter can't be negative, check whether the copied lengths are equal.

vringh incorrectly treated copy_from_iter() as potentially negative and only checked ret < 0. Since copy_from_iter() returns the number of bytes copied (non-negative), short/partial copies were falsely accepted, risking use of incomplete data and subsequent corruption/instability. The fix checks size != translated and returns -EFAULT on mismatch, properly handling faults/short copies in the vhost IOTLB translation path. Exploitation requires local access to the vhost/virtio datapath — i.e. a process that can open and interact with /dev/vhost-* or /dev/kvm. On typical systems this means the attacker must be root or a member of the kvm group. If vhost or kvm not being used, then ordinary unprivileged users do not have access by default.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module vringh from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.