CVE-2026-43248

A flaw was found in the Linux kernel's vhost subsystem. Specifically, a bug in the vdpa_sim component allows for an out-of-bounds write when a valid ASID (Address Space ID) is incorrectly assigned to a vDPA (virtio Data Path Acceleration) group. This could lead to memory corruption, potentially resulting in a denial of service or other system instability.

vhost vdpa did not centrally validate the group index before calling the driver set_group_asid operation. In vdpa_sim, a group value equal to ngroups could pass the old driver check and cause an out of bounds write when assigning a valid ASID to that group. For the CVSS the PR:L value is used because an attacker needs local access to the vhost vdpa or vdpa device interface, commonly through a VM or virtualization management process, but does not necessarily need kernel privileges once that interface is exposed. The issue is not network reachable by itself and is triggered through a local ioctl control path. Impact is at least local denial of service via kernel memory corruption and in the worst case may allow confidentiality or integrity impact due to an out of bounds write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module vdpa from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.