NIXPKGS-2026-0853
GitHub issue
published on 31 Mar 2026
Permalink
CVE-2026-5164
6.7 MEDIUM
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): HIGH
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
by @mweinelt Activity log
- Created automatic suggestion
- @mweinelt accepted
- @mweinelt published on GitHub
Virtio-win: virtio-win: denial of service via unvalidated descriptor count in unmap request
A flaw was found in virtio-win. The `RhelDoUnMap()` function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).
References
- https://access.redhat.com/security/cve/CVE-2026-5164 x_refsource_REDHAT vdb-entry
- RHBZ#2453014 issue-tracking x_refsource_REDHAT
- https://github.com/virtio-win/kvm-guest-drivers-windows/pull/1504
Affected products
virtio-win
Package maintainers
-
@anthonyroussel Anthony Roussel <anthony@roussel.dev>