The Zephyr virtio driver does not validate the descriptor‑chain head id that the virtio device writes into the used ring. This id is taken as a 16‑bit value with no bounds checking and is used directly as an index into callback and descriptor arrays. An attacker able to write an out‑of‑range id can cause an out‑of‑bounds read of a function‑pointer/argument pair from heap memory; the driver then invokes that attacker‑supplied pointer in the guest interrupt context. This flaw provides a control‑flow‑hijack primitive that can lead to arbitrary code execution or a guaranteed crash, representing a high‑severity function‑pointer misuse vulnerability (CWE‑129).

The issue affects Zephyr builds that enable CONFIG_VIRTIO and use the PCI or MMIO virtio transports. The vulnerability exists in any version containing the unpatched virtio_common implementation; no specific version range is published, so all builds with this configuration are considered vulnerable until the official patch is applied.

With a CVSS score of 8.8 the flaw is deemed high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The attack can be carried out by an untrusted hypervisor or a compromised virtio backend on PCI or MMIO transports; no guest‑side privileges or user interaction are required. By writing a crafted used‑ring id and raising the queue interrupt, an attacker can easily trigger the control‑flow hijack, giving execution in the guest with kernel‑like privileges of the virtio driver.