The vdpa_sim_blk driver performs a range check for virtual block device requests, but when the start sector is invalid, the check logs a warning and proceeds with validation. The subsequent unsigned subtraction can underflow, allowing an offset value larger than the allocated buffer to be computed. This faulty offset is then used by three request types—VIRTIO_BLK_T_OUT, VIRTIO_BLK_T_IN, and VIRTIO_BLK_T_WRITE_ZEROES—resulting in out‑of‑bounds writes or reads that corrupt kernel memory.

All Linux kernel implementations that include the vdpa_sim_blk driver and have not yet incorporated the patch that rejects out‑of‑range sector starts are affected. The vulnerability spans all distributions using the upstream Linux kernel where the commit introducing the fix is not present. Any system exposing a virtio‑blk interface to guest virtual machines is potentially vulnerable.

The CVSS score is not provided and the EPSS is unavailable, so the concrete risk assessment relies on the severity implied by a kernel memory corruption. The vulnerability is not yet listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation. Nonetheless, the attack vector is likely from a guest virtual machine communicating with a virtio‑blk device; an attacker could craft a request that uses a start sector beyond the device capacity, causing the kernel to read or write past the buffer limit and potentially achieve privilege escalation to the host.