Linux kernel virtio-crypto: unbounded device-reported result length over-reads guest kernel heap

Impact

The guest driver set the akcipher result length from the length the device reported, without clamping it to the destination buffer allocated for the original request. sg_copy_from_buffer() then copies that many bytes, so a backend reporting a larger length pushes adjacent guest kernel heap into the caller's scatterlist - an out-of-bounds read that surfaces kernel memory to whoever requested the operation. This is a host-to-guest trust boundary failure: a compromised or hostile device backend gets an information leak inside the guest kernel. Its practical reach is narrow, since virtio-crypto is rarely attached to GPU VMs; nodes that do not expose the device are unaffected.

Who can reach it

A malicious or compromised virtio-crypto backend (host-side device emulation) against a guest that has a virtio-crypto device attached and the driver loaded. Inside the guest, the leaked bytes land in the buffer of whichever process requested the akcipher operation; no guest privilege is required to be the recipient.

What to do

Apply the stable kernel fix (linked commits, which clamp the reported length to the requested destination length) to guest kernels and reboot them. The record names commits, not a fixed release. Where patching has to wait, stop exposing virtio-crypto devices to guests or keep the virtio_crypto module unloaded - conforming backends never report more than the requested length, so removing the device removes the exposure.

References

Related entries

• Linux KVM SEV: sub-page command buffer on SNP hosts triggers RMP faults and host panicCVE-2026-80853 · Linux KVM SEV (temporary buffer for {DE,EN}CRYPT ops on SNP-enabled hosts)Unscored
• Linux kernel FUSE: abort_on_kill returns without waiting for FR_FINISHED, freeing an in-flight requestCVE-2026-80857 · Linux kernel FUSE request handling (request_wait_answer abort_on_kill path)Unscored
• Linux kernel nvme-tcp: unserialized page_frag_cache corrupts page refcounts and panics the hostCVE-2026-80862 · Linux kernel nvme-tcp (page_frag_cache used unserialized for per-request PDU preallocation)Unscored
• Linux kernel bpf: copy_user_syms calls __get_user on a userspace pointer array with no access_ok checkCVE-2026-80865 · Linux kernel BPF kprobe_multi attach (copy_user_syms)Unscored
• Linux kernel vmwgfx: integer overflow in the shader offset bound check lets an unbounded offset reach host SVGA commandsCVE-2026-80887 · Linux kernel vmwgfx (vmw_shader_define shader size+offset bound check)Unscored
• Linux kernel vmwgfx: dma_buf reference leaked on foreign prime import pins the exporter's memory indefinitelyCVE-2026-80888 · Linux kernel vmwgfx (ttm_prime_fd_to_handle foreign-fd prime import)Unscored