The Linux kernel’s virtio‑rng driver contains a buffer‑overflow flaw: the host‑side backend reports a length for the data buffer that is not re‑validated before a memcpy is performed. If the reported length is larger than the statically allocated array, the driver reads past the end of the buffer into adjacent kernel memory, producing an out‑of‑bounds read (CWE‑125). The leaked bytes are injected into the guest’s random‑number generator and can be exfiltrated through /dev/hwrng, an interface that any guest‑root user can read, resulting in the disclosure of guest‑kernel heap contents. The CVSS score of 7.7 indicates a moderate‑to‑high severity.

All Linux kernel releases that ship the vulnerable virtio‑rng hwrng driver before the recent security commit are affected. The vulnerability only manifests when the host kernel presents a virtio‑rng backend to the guest; therefore any guest running a vulnerable kernel that accepts a virtio‑rng device is at risk. Guests that do not use virtio‑rng are unaffected. The issue is limited to systems running the virtio‑rng driver in kernel mode.

Exploitation requires a malicious or buggy virtio‑rng backend, which in practice resides in the hypervisor. No guest‑user‑space action is required; the out‑of‑bounds read occurs immediately as the device is probed. The EPSS score of <1% and the lack of inclusion in CISA’s KEV catalog suggest a low probability of real‑world attacks. The vulnerability is deterministic and high‑impact for privileged guests or confidential‑compute workloads that use virtio‑rng, but its tight attack surface keeps the overall risk moderate.