Vulnerability-Lookup

RHBA-2026:70252

Vulnerability from csaf_redhat - Published: 2026-09-22 21:04 - Updated: 2026-11-06 07:06

Summary

Red Hat Bug Fix Advisory: virtio-win bug fix and enhancement update

Severity

Important

Notes

Topic: An update for virtio-win is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.

Details: The virtio-win package provides paravirtualized network drivers for most Microsoft Windows operating systems. Paravirtualized drivers are virtualization-aware drivers used by fully virtualized guests running on Red Hat Enterprise Linux. Fully virtualized guests using the paravirtualized drivers gain significantly better I/O performance than fully virtualized guests running without the drivers.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-46655

A flaw was found in virtio-win. A low-integrity process can issue an IOCTL request to viosock.sys!VIOSockSelect with a maliciously crafted request that causes an integer overflow. This allows the process to circumvent bounds checking, resulting in a heap overflow in the NonPagedPool kernel heap. The flaw could be exploited to escalate privileges on Windows systems running this driver.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:virtio-win-0:1.9.61-0.el9_8.noarch		—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:virtio-win-0:1.9.61-0.el9_8.src		—	Vendor Fix fix Workaround

Threats

Impact Important

References

7 references

URL	Category
https://access.redhat.com/errata/RHBA-2026:70252	self
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-46655	self
https://bugzilla.redhat.com/show_bug.cgi?id=2489170	external
https://www.cve.org/CVERecord?id=CVE-2026-46655	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46655	external
https://github.com/virtio-win/kvm-guest-drivers-w…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for virtio-win is now available for Red Hat Enterprise Linux 10.0\nExtended Update Support.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The virtio-win package provides paravirtualized network drivers for most\nMicrosoft Windows operating systems. Paravirtualized drivers are\nvirtualization-aware drivers used by fully virtualized guests running on Red Hat\nEnterprise Linux. Fully virtualized guests using the paravirtualized drivers\ngain significantly better I/O performance than fully virtualized guests running\nwithout the drivers.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2026:70252",
        "url": "https://access.redhat.com/errata/RHBA-2026:70252"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhba-2026_70252.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: virtio-win bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-11-06T07:06:30+00:00",
      "generator": {
        "date": "2026-11-06T07:06:30+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHBA-2026:70252",
      "initial_release_date": "2026-09-22T21:04:55+00:00",
      "revision_history": [
        {
          "date": "2026-09-22T21:04:55+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-22T21:04:55+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-06T07:06:30+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "virtio-win-0:1.9.61-0.el9_8.src",
                "product": {
                  "name": "virtio-win-0:1.9.61-0.el9_8.src",
                  "product_id": "virtio-win-0:1.9.61-0.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/virtio-win@1.9.61-0.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "virtio-win-0:1.9.61-0.el9_8.noarch",
                "product": {
                  "name": "virtio-win-0:1.9.61-0.el9_8.noarch",
                  "product_id": "virtio-win-0:1.9.61-0.el9_8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/virtio-win@1.9.61-0.el9_8?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "virtio-win-0:1.9.61-0.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:virtio-win-0:1.9.61-0.el9_8.noarch"
        },
        "product_reference": "virtio-win-0:1.9.61-0.el9_8.noarch",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "virtio-win-0:1.9.61-0.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:virtio-win-0:1.9.61-0.el9_8.src"
        },
        "product_reference": "virtio-win-0:1.9.61-0.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-46655",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-06-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2489170"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in virtio-win. A low-integrity process can issue an IOCTL request to viosock.sys!VIOSockSelect with a maliciously crafted request that causes an integer overflow. This allows the process to circumvent bounds checking, resulting in a heap overflow in the NonPagedPool kernel heap. The flaw could be exploited to escalate privileges on Windows systems running this driver.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "virtio-win: viosock.sys: integer overflow in VIOSockSelect leads to heap-based buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:virtio-win-0:1.9.61-0.el9_8.noarch",
          "AppStream-9.8.0.Z.MAIN.EUS:virtio-win-0:1.9.61-0.el9_8.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46655"
        },
        {
          "category": "external",
          "summary": "RHBZ#2489170",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489170"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46655",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46655"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46655",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46655"
        },
        {
          "category": "external",
          "summary": "https://github.com/virtio-win/kvm-guest-drivers-windows/security/advisories/GHSA-qrhp-4mhp-hjwh",
          "url": "https://github.com/virtio-win/kvm-guest-drivers-windows/security/advisories/GHSA-qrhp-4mhp-hjwh"
        }
      ],
      "release_date": "2026-06-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-22T21:04:55+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:virtio-win-0:1.9.61-0.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:virtio-win-0:1.9.61-0.el9_8.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2026:70252"
        },
        {
          "category": "workaround",
          "details": "This flaw requires local access to a Windows guest with the virtio-vsock driver installed. The following steps reduce exposure:\n\n1. Disable the viosock driver on guests that do not need VM socket communication. Stop the viosock service and set its startup type to Disabled. This eliminates the attack surface entirely and is the strongest interim mitigation.\n2. Verify memory protections are active in the guest. These raise the cost of exploiting the heap overflow significantly.\n3. Minimize guest-to-host attack surface on the hypervisor. Even a full guest kernel compromise is contained by the KVM boundary. Disable unnecessary virtio devices and limit PCI passthrough to reduce the risk of chaining with a separate host escape.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:virtio-win-0:1.9.61-0.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:virtio-win-0:1.9.61-0.el9_8.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:virtio-win-0:1.9.61-0.el9_8.noarch",
            "AppStream-9.8.0.Z.MAIN.EUS:virtio-win-0:1.9.61-0.el9_8.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "virtio-win: viosock.sys: integer overflow in VIOSockSelect leads to heap-based buffer overflow"
    }
  ]
}

CVE-2026-46655 (GCVE-0-2026-46655)

Vulnerability from cvelistv5 – Published: 2026-09-18 16:46 – Updated: 2026-09-23 19:15

Title

virtio-win: Integer overflow causing a heap overflow in Viosock driver

Summary

virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_SELECT request with attacker-controlled VIRTIO_VSOCK_SELECT.Fdss[*].fd_count values that overflow the 32-bit sum used by VIOSockSelect for bounds checking. The wrapped sum can pass the FD_SETSIZE check even though an individual descriptor count is much larger than the expected limit. VIOSockSelectCopyFds then iterates using the unchecked count and writes beyond the allocated pPkt->Fds array in the NonPagedPool kernel heap. Successful exploitation can corrupt kernel memory and enable privilege escalation in a Windows guest running the driver. This issue is fixed in mm320.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 19:14 UTC

CWE

CWE-122 - Heap-based Buffer Overflow
CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8094 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/virtio-win/kvm-guest-drivers-w…	x_refsource_CONFIRM
https://github.com/virtio-win/kvm-guest-drivers-w…	x_refsource_MISC
https://github.com/virtio-win/kvm-guest-drivers-w…	x_refsource_MISC
https://github.com/virtio-win/kvm-guest-drivers-w…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
virtio-win	kvm-guest-drivers-windows	Affected: >= mm210, < mm320

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46655",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:14:57.635548Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:15:05.093Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/virtio-win/kvm-guest-drivers-windows/security/advisories/GHSA-qrhp-4mhp-hjwh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kvm-guest-drivers-windows",
          "vendor": "virtio-win",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= mm210, \u003c mm320"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_SELECT request with attacker-controlled VIRTIO_VSOCK_SELECT.Fdss[*].fd_count values that overflow the 32-bit sum used by VIOSockSelect for bounds checking. The wrapped sum can pass the FD_SETSIZE check even though an individual descriptor count is much larger than the expected limit. VIOSockSelectCopyFds then iterates using the unchecked count and writes beyond the allocated pPkt-\u003eFds array in the NonPagedPool kernel heap. Successful exploitation can corrupt kernel memory and enable privilege escalation in a Windows guest running the driver. This issue is fixed in mm320."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T16:46:50.352Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/virtio-win/kvm-guest-drivers-windows/security/advisories/GHSA-qrhp-4mhp-hjwh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/virtio-win/kvm-guest-drivers-windows/security/advisories/GHSA-qrhp-4mhp-hjwh"
        },
        {
          "name": "https://github.com/virtio-win/kvm-guest-drivers-windows/pull/1568",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/virtio-win/kvm-guest-drivers-windows/pull/1568"
        },
        {
          "name": "https://github.com/virtio-win/kvm-guest-drivers-windows/commit/c6bef93d7909584bbda4e5c87603ea175825f342",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/virtio-win/kvm-guest-drivers-windows/commit/c6bef93d7909584bbda4e5c87603ea175825f342"
        },
        {
          "name": "https://github.com/virtio-win/kvm-guest-drivers-windows/releases/tag/mm320",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/virtio-win/kvm-guest-drivers-windows/releases/tag/mm320"
        }
      ],
      "source": {
        "advisory": "GHSA-qrhp-4mhp-hjwh",
        "discovery": "UNKNOWN"
      },
      "title": "virtio-win: Integer overflow causing a heap overflow in Viosock driver"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-46655",
    "datePublished": "2026-09-18T16:46:34.832Z",
    "dateReserved": "2026-05-15T20:11:54.585Z",
    "dateUpdated": "2026-09-23T19:15:05.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted