CVE-2026-13212: Zephyr virtio Driver RCE Vulnerability

CVE-2026-13212 Overview

CVE-2026-13212 is an out-of-bounds read vulnerability in the Zephyr RTOS virtio driver. The driver in drivers/virtio/virtio_common.c fails to validate the descriptor-chain head id that the virtio device writes into the used ring. A malicious or compromised virtio backend can supply an id far beyond vq->num, causing the driver to read a function pointer from attacker-influenced heap memory and invoke it. The result is a control-flow hijack primitive in the guest's interrupt context. The issue affects builds using CONFIG_VIRTIO with the PCI or MMIO transport.

Critical Impact
An untrusted hypervisor or peer virtio device can trigger an arbitrary function-pointer call in the Zephyr guest with no guest privileges or user interaction, enabling code execution or reliable denial of service.

Affected Products

Zephyr RTOS builds with CONFIG_VIRTIO enabled
Zephyr virtio PCI transport
Zephyr virtio MMIO transport

Discovery Timeline

2026-08-24 - CVE-2026-13212 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-13212

Vulnerability Analysis

The vulnerability resides in the virtio_isr() function inside drivers/virtio/virtio_common.c. When the virtio device signals a completed descriptor chain, it writes an id into the used ring at vq->used->ring[idx].id. The Zephyr driver consumes this 16-bit id and uses it directly as an index into two heap-allocated arrays: vq->recv_cbs[] and vq->desc[]. Both arrays are sized to exactly vq->num entries.

Because the id originates from the untrusted device side of the shared ring, an attacker-controlled backend can supply values well beyond vq->num. The recv_cbs[] array holds {cb, opaque} pairs, and the driver invokes the indexed callback as cbe.cb(cbe.opaque, used_len). Reading past the array yields attacker-shaped memory, resulting in an arbitrary function pointer call inside the guest's interrupt context. This maps to [CWE-129] Improper Validation of Array Index.

Root Cause

The root cause is a missing bounds check on device-supplied input. The driver treats the used-ring descriptor id as trusted despite the virtio threat model, where the backend is untrusted on PCI or MMIO transports. No comparison between chain_head and vq->num occurs before the array dereference.

Attack Vector

Exploitation requires an adjacent position with control over the virtio backend. This includes an untrusted hypervisor, a malicious peer processor exposing a virtio device, or compromised hardware on the PCI or MMIO bus. The attacker writes a crafted id into the shared used ring and raises the queue interrupt. The Zephyr guest then reads a {function pointer, argument} pair from out-of-bounds heap memory and calls it.

					vq->used->ring[idx_le].len
 				);
 
+				/*
+				 * The used ring is written by the (untrusted) device.
+				 * A descriptor id beyond the queue size would index
+				 * recv_cbs[]/desc[] out of bounds and lead to an
+				 * arbitrary callback pointer being invoked below.
+				 */
+				if (chain_head >= vq->num) {
+					LOG_ERR("invalid used ring id %u (num %u)",
+						chain_head, vq->num);
+					vq->last_used_idx++;
+					continue;
+				}

Source: Zephyr commit fe47dbc

Detection Methods for CVE-2026-13212

Indicators of Compromise

Log entries containing invalid used ring id emitted by the patched driver, indicating a backend supplied an out-of-range descriptor id.
Unexpected Zephyr guest crashes, faults, or resets originating from the virtio interrupt handler.
Anomalous control-flow transfers from virtio_isr() to addresses outside the driver's callback registration set.

Detection Strategies

Audit Zephyr builds for CONFIG_VIRTIO=y combined with PCI or MMIO transport and confirm the fix from commit fe47dbc is present.
Instrument the virtio used-ring processing path with assertions that log any chain_head >= vq->num event.
Correlate hypervisor-side telemetry on used-ring writes with guest-side interrupt exceptions to identify malformed descriptors.

Monitoring Recommendations

Monitor guest kernel logs for virtio driver error strings and unexpected callback invocations.
Track firmware supply chain updates for Zephyr-based devices to confirm patched revisions are deployed.
Alert on repeated Zephyr guest resets on systems that pair Zephyr with untrusted peer processors or hypervisors.

How to Mitigate CVE-2026-13212

Immediate Actions Required

Apply the upstream fix from Zephyr commit fe47dbca080957c425383cc1d5bdc7d48a41d4a5 to all Zephyr builds using virtio PCI or MMIO transport.
Rebuild and reflash affected Zephyr firmware images and validate the patched behavior on the target hardware.
Inventory all Zephyr guests that communicate with third-party hypervisors or peer processors over virtio.

Patch Information

The fix rejects any used-ring id where chain_head >= vq->num before indexing recv_cbs[] or desc[] or invoking the callback. Details are available in the Zephyr Security Advisory GHSA-7884-373w-qqhx and the upstream commit.

Workarounds

Disable CONFIG_VIRTIO in Zephyr builds where virtio is not required.
Restrict Zephyr guests to trusted hypervisors and trusted peer virtio devices until the patch is deployed.
Isolate PCI or MMIO transports that expose Zephyr to untrusted backends using platform-level access controls.

bash

# Verify the fix is present in the local Zephyr source tree
git -C zephyr log --oneline | grep fe47dbca08
grep -n "invalid used ring id" zephyr/drivers/virtio/virtio_common.c