CVE-2025-40056

A flaw was found in the Linux kernel's vhost/vringh component. This vulnerability arises from an improper check of the copy_to_iter() function's return value, which could lead to the system processing partially copied data. A local attacker with access to the vhost/virtio path (such as root or a user in the kvm/vhost group) could exploit this to cause data corruption or trigger a kernel fault, leading to a denial of service.

The fix corrects an improper check of copy_to_iter() in vringh.c. Since copy_to_iter() never returns a negative value, the old code failed to detect short copies. And the new code treats size != translated as an error (-EFAULT). Without the fix, vringh could proceed with partially copied data, risking data corruption and possible kernel faults. Exploitation requires local access to the vhost/virtio path (typically root or membership in kvm/vhost), so the impact is limited to local integrity/availability issues.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.