CVE-2026-64456

A flaw was found in the Linux kernel's virtio-rng driver. A malicious or buggy virtualized hardware random number generator (virtio-rng) backend can report an overly large data length to the guest operating system. This unchecked length can lead to an out-of-bounds read, causing the driver to access memory beyond its intended buffer. This vulnerability can result in information disclosure, where sensitive guest-kernel heap data may be leaked to a malicious hypervisor or a compromised guest root user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.