In the Linux kernel, the vhost/vdpa subsystem allows a caller to set a virtual queue (vring) size via VHOST_SET_VRING_NUM. The vhost_vring_set_num() routine accepts any non‑zero power‑of‑two queue size that fits in 16 bits and forwards this value to set_vq_num() without verifying it against the device’s maximum queue size obtained from get_vq_num_max(). A process with access to /dev/vhost‑vdpa‑* can therefore configure a queue larger than the device advertises. When the backend processes packets it walks beyond the mapped descriptor ring, triggering a 16‑byte out-of-bounds read reported by KASAN in the vringh IOTLB path. This out‑of-bounds read can leak kernel memory contents and, in a kernel context, may be leveraged to gain elevated privileges or destabilize the system.

The vulnerability resides in the generic Linux kernel source, so any distribution that ships a kernel revision containing the unguarded vhost/vdpa code is affected. The patch was applied after commit c1d09201 in the kernel’s mainline; therefore all kernel versions released before that commit are susceptible. No specific distribution version list is supplied by the CNA, but users should check whether their kernel was built prior to the fix and plan an upgrade accordingly.

The EPSS score is < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack requires local access to /dev/vhost‑vdpa‑* and the ability to issue VHOST_SET_VRING_NUM, which typically implies privileged or compromised local users. The CVSS score of 5.5 places the flaw in the moderate severity range. Nevertheless, the kernel out‑of-bounds read could allow an attacker to read arbitrary kernel memory, potentially leading to privilege escalation or denial of service. While exploitation may be non‑trivial, the potential impact is system‑wide kernel compromise. Given the severity of a kernel memory corruption flaw, the risk is considered high.