CVE-2026-13212

Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id

Published Aug 24, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virtio_common.c), the device-written vq->used->ring[idx].id is used directly as an index into vq->recv_cbs[] and vq->desc[], which are both allocated with exactly vq->num entries. recv_cbs[] holds {cb, opaque} callback entries, and the indexed callback pointer is then invoked as cbe.cb(cbe.opaque, used_len).

Because the id is consumed as a 16-bit value with no bound check, a malicious or compromised virtio backend (an untrusted hypervisor, or an untrusted hardware/peer-processor virtio device on a PCI or MMIO transport) can supply an id far beyond vq->num. This causes an out-of-bounds read of a {function pointer, argument} pair from heap memory beyond recv_cbs[], after which the driver calls that attacker-shaped pointer in the guest's interrupt context. No guest privileges or user interaction are required; the backend triggers it by writing the shared used ring and raising the queue interrupt.

The result is an arbitrary / attacker-influenced function-pointer call in the Zephyr guest, i.e. a control-flow-hijack primitive that can lead to code execution or, at minimum, a reliable crash. The fix rejects any used-ring id >= vq->num before indexing recv_cbs[]/desc[] or invoking the callback. This affects builds using CONFIG_VIRTIO with the PCI or MMIO transport.

Analysis

Technical impact

The Zephyr virtio driver does not validate the descriptor‑chain head id that the virtio device writes into the used ring. This id is taken as a 16‑bit value with no bounds checking and is used directly as an index into callback and descriptor arrays. An attacker able to write an out‑of‑range id can cause an out‑of‑bounds read of a function‑pointer/argument pair from heap memory; the driver then invokes that attacker‑supplied pointer in the guest interrupt context. This flaw provides a control‑flow‑hijack primitive that can lead to arbitrary code execution or a guaranteed crash, representing a high‑severity function‑pointer misuse vulnerability (CWE‑129).

Affected Systems

The issue affects Zephyr builds that enable CONFIG_VIRTIO and use the PCI or MMIO virtio transports. The vulnerability exists in any version containing the unpatched virtio_common implementation; no specific version range is published, so all builds with this configuration are considered vulnerable until the official patch is applied.

Risk and Exploitability

With a CVSS score of 8.8 the flaw is deemed high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The attack can be carried out by an untrusted hypervisor or a compromised virtio backend on PCI or MMIO transports; no guest‑side privileges or user interaction are required. By writing a crafted used‑ring id and raising the queue interrupt, an attacker can easily trigger the control‑flow hijack, giving execution in the guest with kernel‑like privileges of the virtio driver.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

zephyrproject

zephyr

unaffected

Version	Status	Constraints
`4.2.0`	affected	< 4.3.2
`4.4.0`	affected	< 4.4.2

No data.

Vendor Product Versions

Zephyrproject

Zephyr

Version	Status	Scheme	Platform
`[4.2.0,4.4.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a Zephyr release that includes the virtio_common patch rejecting used‑ring ids >= vq->num.
Rebuild your Zephyr system with the latest source containing the fix, ensuring that CONFIG_VIRTIO is enabled for PCI or MMIO transports.
Confirm that any hypervisor or virtio backend interacting with your Zephyr build enforces descriptor bounds or is updated to a compatible version to prevent malicious id injection.

Generated by OpenCVE AI on August 24, 2026 at 19:42 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.367% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/zephyrproject-rtos/zephyr/commit/fe47dbca080957c425383cc1d5bdc7d48a41d4a5
https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7884-373w-qqhx

History

Aug 24, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 24, 2026 5:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Zephyrproject Zephyrproject zephyr
Vendors & Products		Zephyrproject Zephyrproject zephyr

Aug 24, 2026 4:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virtio_common.c), the device-written vq->used->ring[idx].id is used directly as an index into vq->recv_cbs[] and vq->desc[], which are both allocated with exactly vq->num entries. recv_cbs[] holds {cb, opaque} callback entries, and the indexed callback pointer is then invoked as cbe.cb(cbe.opaque, used_len). Because the id is consumed as a 16-bit value with no bound check, a malicious or compromised virtio backend (an untrusted hypervisor, or an untrusted hardware/peer-processor virtio device on a PCI or MMIO transport) can supply an id far beyond vq->num. This causes an out-of-bounds read of a {function pointer, argument} pair from heap memory beyond recv_cbs[], after which the driver calls that attacker-shaped pointer in the guest's interrupt context. No guest privileges or user interaction are required; the backend triggers it by writing the shared used ring and raising the queue interrupt. The result is an arbitrary / attacker-influenced function-pointer call in the Zephyr guest, i.e. a control-flow-hijack primitive that can lead to code execution or, at minimum, a reliable crash. The fix rejects any used-ring id >= vq->num before indexing recv_cbs[]/desc[] or invoking the callback. This affects builds using CONFIG_VIRTIO with the PCI or MMIO transport.
Title		Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id
Weaknesses		CWE-129
References		https://github.com/zephyrproject-rtos/zephyr/commit/fe47dbca080957c425383cc1d5bdc7d48a41d4a5 https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7884-373w-qqhx
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`