In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhost_vdpa_mmap() and vhost_vdpa_fault() use vma->vm_pgoff as a virtqueue index for get_vq_notification(), but they do not validate that the index is smaller than v->nvqs. The ioctl path already performs both a bounds check and array_index_nospec(), but the mmap/fault path only checks that the index fits in u16. This allows an out-of-range queue index to reach driver-specific get_vq_notification() callbacks. Fix this by extracting a unified vhost_vdpa_get_vq_notification() helper that validates the queue index against v->nvqs and applies array_index_nospec() before calling the driver callback. Both the mmap and fault paths use this helper, and the bounds checking is consolidated into a single location. From source inspection, the most defensible impact is out-of-bounds access in the callback path, potentially leading to invalid PFN remaps and crash/DoS.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
References
Link Providers
https://git.kernel.org/stable/c/0f310bac6db9bd3bb1655707d692d9d2a86eeb17 cve-icon cve-icon
https://git.kernel.org/stable/c/1f5f94c6c6b2e4eaa5b45815509e21d0c6cfa81e cve-icon cve-icon
https://git.kernel.org/stable/c/2b3f79b90b231a682315fe2191bb71925650e183 cve-icon cve-icon
https://git.kernel.org/stable/c/32ac9097aa2463fcfc12f61cc4a9ebc3579cba7d cve-icon cve-icon
https://git.kernel.org/stable/c/4bf5a51963ff816f7443702dc536b9327cf5e550 cve-icon cve-icon
https://git.kernel.org/stable/c/55a644031e610ea93fbde2702c7b8f267476552f cve-icon cve-icon
https://git.kernel.org/stable/c/929e4f044621c8cc30b612fb74e1410bef09e41b cve-icon cve-icon
https://git.kernel.org/stable/c/bbba4f92515238d76018e9b75e41b16d83df52c8 cve-icon cve-icon
History

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-20

Sat, 15 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhost_vdpa_mmap() and vhost_vdpa_fault() use vma->vm_pgoff as a virtqueue index for get_vq_notification(), but they do not validate that the index is smaller than v->nvqs. The ioctl path already performs both a bounds check and array_index_nospec(), but the mmap/fault path only checks that the index fits in u16. This allows an out-of-range queue index to reach driver-specific get_vq_notification() callbacks. Fix this by extracting a unified vhost_vdpa_get_vq_notification() helper that validates the queue index against v->nvqs and applies array_index_nospec() before calling the driver callback. Both the mmap and fault paths use this helper, and the bounds checking is consolidated into a single location. From source inspection, the most defensible impact is out-of-bounds access in the callback path, potentially leading to invalid PFN remaps and crash/DoS.
Title vhost/vdpa: validate virtqueue index in mmap and fault paths
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:58:11.395Z

Reserved: 2026-08-15T05:44:03.883Z

Link: CVE-2026-74312

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:31.310

Modified: 2026-08-15T06:22:31.310

Link: CVE-2026-74312

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T12:30:07Z