CVE-2026-74312
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, vhost_vdpa_mmap() and vhost_vdpa_fault() do not properly validate the virtqueue index before using it in get_vq_notification(). Missing check that the index is less than v->nvqs allows an out-of-range index to reach the driver, potentially leading to out-of-bounds access and system crash.
Risk Assessment
The vulnerability may allow an attacker to trigger out-of-bounds access in the mmap/fault path, potentially leading to invalid PFN remaps and system crash (DoS).
Recommendation
Install the Linux kernel patch that adds a unified helper vhost_vdpa_get_vq_notification() with index validation and array_index_nospec() before calling the driver callback.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhost_vdpa_mmap() and vhost_vdpa_fault() use vma->vm_pgoff as a virtqueue index for get_vq_notification(), but they do not validate that the index is smaller than v->nvqs. The ioctl path already performs both a bounds check and array_index_nospec(), but the mmap/fault path only checks that the index fits in u16. This allows an out-of-range queue index to reach driver-specific get_vq_notification() callbacks. Fix this by extracting a unified vhost_vdpa_get_vq_notification() helper that validates the queue index against v->nvqs and applies array_index_nospec() before calling the driver callback. Both the mmap and fault paths use this helper, and the bounds checking is consolidated into a single location. From source inspection, the most defensible impact is out-of-bounds access in the callback path, potentially leading to invalid PFN remaps and crash/DoS.