CVE-2026-97994

A flaw was found in the Linux kernel's vhost-vDPA (virtio Data Path Acceleration) subsystem. A local user with access to a vhost-vDPA device can configure a queue size that exceeds the device's maximum supported capacity due to insufficient boundary validation. This improper validation can lead to an out-of-bounds memory read, resulting in a Denial of Service (DoS) through a system crash or potential information disclosure.

A moderate-impact flaw was found in the Linux kernel's vhost-vDPA subsystem as shipped in Red Hat Enterprise Linux 8, 9, and 10 (including Real Time kernels), RHEL CoreOS, and RHIVOS. The vhost_vring_set_num() function accepted any non-zero power-of-two queue size passed via the VHOST_SET_VRING_NUM ioctl without comparing it with the maximum queue size advertised by the device (get_vq_num_max()). A local user with access to a /dev/vhost-vdpa-* device node could therefore configure a virtqueue larger than the device supports, causing the vringh descriptor processing to read beyond the end of the mapped descriptor ring. This out-of-bounds read can crash the kernel, resulting in a denial of service; the read data is consumed internally by the descriptor worker, so only a theoretical risk of limited information disclosure remains. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those releases. Fixes for the affected releases are currently deferred: exploitation requires local access to a vhost-vDPA device node, which is normally restricted to privileged users and virtualization service accounts, and the primary consequence is a local denial of service, so the residual risk of deferring the fix is considered limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.