Linux kernel vhost vringh: copy helper return values checked for negative instead of short copies

Impact

vringh checked the results of copy_from_iter() and copy_to_iter() as if they could be negative; they cannot, so a short copy went undetected and the code continued as though the full length had been transferred. The upstream fix compares the copied length against the requested length instead. The record is a one-line changelog with no described attacker path or demonstrated impact, so the honest reading is an unvalidated-length defect in the host-side virtio ring helper that backs vhost-vdpa and VDUSE. That is a host-kernel component used by VM-based and vDPA-accelerated networking on GPU hosts, which is why it is tracked here, but nothing in the record supports treating it as remotely reachable or as a confirmed escalation.

Who can reach it

Local, host side. Requires a configuration that uses vringh - vhost-vdpa or VDUSE - and the ability to drive the virtio ring from the userspace or device side of that interface, which is a privileged operation. The record does not establish an unprivileged or tenant-reachable path.

What to do

Take the stable kernel update that compares copied against requested length (five backports linked) with your regular kernel maintenance; rollout is drain and reboot per node. Hosts not using vhost-vdpa or VDUSE do not exercise this code. The record names no fixed release beyond these commits and no configuration mitigation.

References

Related entries

• Linux kernel (net/smc): Connect() on an SMC socket takes the destination device pointer out of the dst cache without aCVE-2025-40064 · Linux kernel (net/smc)High
• Linux kernel arm_spe: integer overflow in PERF_IDX2OFF with AUX buffers of 2 GiB or moreCVE-2025-40081 · Linux kernel perf arm_spe (PERF_IDX2OFF integer overflow)High
• Linux kernel (drivers/gpu/drm/scheduler): When adding reservation-object dependencies to a job, the helper alreadyCVE-2025-40096 · Linux kernel (drivers/gpu/drm/scheduler)High
• Linux kernel (drivers/gpu/drm/vmwgfx): A guest process can get a node left in the vmwgfx validation hash table afterCVE-2025-40111 · Linux kernel (drivers/gpu/drm/vmwgfx)High
• Linux kernel pm80xx: out-of-bounds phy array index when unloading the driver behind a SAS expanderCVE-2025-40118 · Linux kernel scsi pm80xx (phy array index on device teardown)High
• Linux kernel BPF: tailcalls ignore expected_attach_type, yielding NULL deref and bypassed context checksCVE-2025-40123 · Linux kernel BPF tailcall map compatibility (__bpf_prog_map_compatible)High