Linux kernel virtio-crypto: unbounded device-reported result length over-reads guest kernel heap

Impact

The guest driver set the akcipher result length from the length the device reported, without clamping it to the destination buffer allocated for the original request. sg_copy_from_buffer() then copies that many bytes, so a backend reporting a larger length pushes adjacent guest kernel heap into the caller's scatterlist - an out-of-bounds read that surfaces kernel memory to whoever requested the operation. This is a host-to-guest trust boundary failure: a compromised or hostile device backend gets an information leak inside the guest kernel. Its practical reach is narrow, since virtio-crypto is rarely attached to GPU VMs; nodes that do not expose the device are unaffected.

Who can reach it

A malicious or compromised virtio-crypto backend (host-side device emulation) against a guest that has a virtio-crypto device attached and the driver loaded. Inside the guest, the leaked bytes land in the buffer of whichever process requested the akcipher operation; no guest privilege is required to be the recipient.

What to do

Apply the stable kernel fix (linked commits, which clamp the reported length to the requested destination length) to guest kernels and reboot them. The record names commits, not a fixed release. Where patching has to wait, stop exposing virtio-crypto devices to guests or keep the virtio_crypto module unloaded - conforming backends never report more than the requested length, so removing the device removes the exposure.

References

Related entries

• Linux KVM SEV: sub-page command buffer on SNP hosts triggers RMP faults and host panicCVE-2026-80853 · Linux KVM SEV (temporary buffer for {DE,EN}CRYPT ops on SNP-enabled hosts)Unscored
• Linux kernel FUSE: interrupted DAX truncate on O_TRUNC open leaks the invalidate lock, wedging the fileCVE-2026-80855 · Linux kernel FUSE (DAX truncate path in fuse_open)Unscored
• Linux kernel FUSE: setattr writeback failure leaks the invalidate lock on a DAX truncateCVE-2026-80856 · Linux kernel FUSE (DAX truncate path in fuse_do_setattr)Unscored
• Linux kernel FUSE: abort_on_kill returns without waiting for FR_FINISHED, freeing an in-flight requestCVE-2026-80857 · Linux kernel FUSE request handling (request_wait_answer abort_on_kill path)Unscored
• Linux kernel FUSE: io_uring queues published without release ordering can be read half-initializedCVE-2026-80858 · Linux kernel FUSE (io_uring queue publication ordering)Unscored
• Linux kernel FUSE: missing read barrier in the io-uring readiness check can reintroduce a lock-order deadlockCVE-2026-80859 · Linux kernel FUSE (fuse-over-io-uring readiness check in fuse_block_alloc)Unscored