Linux kernel vhost-vdpa: ASID equal to ngroups passes validation, giving an out-of-bounds write in vdpa_sim

Impact

Group bound checks were scattered across vdpa parent drivers; consolidating them in vhost_vdpa exposed that vdpa_sim accepted an address-space id assigned to a group index equal to ngroups, one past the end, producing an out-of-bounds write. The affected write is in the vdpa simulator, which is a development and test parent driver, not something a production GPU fleet normally loads - so for most operators the real content here is the missing validation in the common vhost_vdpa path plus a kernel heap write on any host where vdpa_sim* is present. Where vhost-vdpa is used to give tenant VMs accelerated networking, the ioctl surface belongs to the VMM, so the attacker is a local user or a tenant's VMM process, and a successful write is host-level compromise on a node holding other tenants' GPUs.

Who can reach it

Local user with access to a vhost-vdpa device node (/dev/vhost-vdpa-N), typically the VMM process or a privileged networking component. The out-of-bounds write specifically requires the vdpa_sim parent driver to be in use; check with lsmod | grep vdpa.

What to do

Update to a stable kernel with the consolidated bound checks (four branches carry backports) and reboot the node. Before scheduling that window, check whether vdpa_sim/vdpa_sim_net is loaded at all - on a production fleet it usually is not, and blacklisting it removes the out-of-bounds write without a reboot, leaving only the hardening part of the change pending.

References

Related entries

• Linux kernel mm: stale page->private survives page free and causes a use-after-free in the swap subsystemCVE-2026-43303 · Linux kernel mm/page_alloc (page->private not cleared in free_pages_prepare)High
• Linux kernel BPF verifier: register used by an indirect jump is not marked liveCVE-2026-43321 · Linux kernel BPF verifier (compute_insn_live_regs, gotox indirect jumps)High
• Linux kernel io_uring: legacy buffer recycle does not re-check that the buffer list still exists or is legacyCVE-2026-43366 · Linux kernel io_uring provided buffers (kbuf legacy recycle path)High
• Linux kernel (net/rds): When pinning user pages for a zerocopy RDS send fails, the pages are released but theCVE-2026-43494 · Linux kernel (net/rds)High
• Linux kernel (net/rds): A zerocopy RDS send that fails after pinning user pages but before the message reaches theCVE-2026-43502 · Linux kernel (net/rds)High
• Linux kernel BPF: negative CO-RE accessor index causes an out-of-bounds read and deterministic kernel crashCVE-2026-45839 · Linux kernel BPF verifier (bpf_core_parse_spec CO-RE accessor parsing)High