CVE-2026-72380

A flaw was found in the Linux kernel's xen/pvcalls component. A malicious or buggy backend could send a specially crafted request identifier that, when processed, would lead to an out-of-bounds write. This could result in memory corruption and potentially cause the frontend to stop trusting the backend, leading to a denial of service for affected operations.

A moderate out-of-bounds write flaw was found in the Linux kernel's xen/pvcalls front-end driver. No Red Hat products are affected: all Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams have been evaluated as not affected because the vulnerable code is not present in the shipped kernels. The flaw exists because pvcalls_front_event_handler() used a request identifier (req_id) taken directly from a backend-supplied ring response to index the fixed-size bedata->rsp[] array for a memcpy() and a store, with no range check, and req_id was declared as a signed int while the wire field is u32. A malicious or buggy Xen backend could supply an out-of-range req_id, including values that wrap to a negative index, and drive an out-of-bounds write past the bedata->rsp[] allocation, causing memory corruption and denial of service for pvcalls operations in the frontend guest. Exploitation requires an attacker to control or compromise the Xen backend, which is a privileged and trusted component of the virtualization stack; because the pvcalls front-end otherwise trusts its backend, this is primarily a hardening concern for confidential and disaggregated deployments with untrusted backends rather than a classic Xen security issue. For this reason Red Hat rates the flaw as moderate impact (CVSS 5.5, affecting availability only), which differs from the important severity (CVSS 8.8) assigned in the upstream CVE record, where the attacker is modeled as an adjacent adversary controlling the backend.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.