CVE-2026-43248: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43248 Overview

CVE-2026-43248 is a Linux kernel vulnerability in the vhost-vdpa subsystem. The flaw affects the vdpa_sim driver, where a valid Address Space Identifier (ASID) can be assigned to a group equal to ngroups, triggering an out-of-bounds write. The fix consolidates the vDPA group bound check into vhost_vdpa to remove duplication and prevent parent drivers from omitting the validation.

Critical Impact
An out-of-bounds write in kernel memory can lead to memory corruption, denial of service, or potential local privilege escalation when an attacker controls ASID assignment to a vDPA device group.

Affected Products

Linux kernel vhost-vdpa subsystem
Linux kernel vdpa_sim driver
Downstream vDPA parent drivers relying on vhost-vdpa group validation

Discovery Timeline

2026-05-06 - CVE-2026-43248 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43248

Vulnerability Analysis

The vulnerability resides in the virtual Data Path Acceleration (vDPA) framework within the Linux kernel. The vhost-vdpa interface allows userspace to manage ASIDs across device groups. Each vDPA device exposes a fixed number of groups represented by ngroups, and ASID assignment must remain bounded by this value.

The vdpa_sim driver accepted an ASID assignment for a group index equal to ngroups. Valid indices range from 0 to ngroups - 1, so writing at offset ngroups overruns the underlying group array. This produces an out-of-bounds write in kernel space.

Bound checks were also duplicated across multiple parent drivers, raising the risk that future parent drivers would omit the check entirely. The patch series consolidates the validation in vhost_vdpa to enforce it uniformly.

Root Cause

The root cause is an off-by-one boundary condition combined with scattered, duplicated validation logic. The vdpa_sim driver used a <= ngroups comparison instead of < ngroups when validating the group index supplied through the ASID assignment path, allowing writes beyond the allocated group array.

Attack Vector

Exploitation requires local access to the /dev/vhost-vdpa-N character device. A privileged user or a process with sufficient capabilities to interact with vhost-vdpa ioctls can craft an ASID assignment that targets the boundary group index. Refer to Linux Kernel Commit 7441d35 and Linux Kernel Commit ddb5735 for the corrective patches.

Detection Methods for CVE-2026-43248

Indicators of Compromise

Kernel log entries referencing vhost_vdpa faults, KASAN slab-out-of-bounds reports, or general protection fault traces involving vDPA group structures.
Unexpected processes opening /dev/vhost-vdpa-* device nodes outside of normal virtualization workflows.
Crashes or panics in vdpa_sim related code paths during ASID configuration.

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface out-of-bounds writes during fuzzing of vhost-vdpa ioctls.
Audit ioctl syscalls targeting vhost-vdpa devices for VHOST_VDPA_SET_GROUP_ASID operations with anomalous group indices.
Compare running kernel versions against patched stable releases referenced in the upstream commits.

Monitoring Recommendations

Forward dmesg and journald kernel messages to a centralized log platform and alert on vhost_vdpa or vdpa_sim warnings.
Track which UIDs and containers access /dev/vhost-vdpa-* and baseline expected access patterns.
Monitor for unexpected loading of the vdpa_sim module on production hosts that do not require it.

How to Mitigate CVE-2026-43248

Immediate Actions Required

Apply the upstream stable kernel updates that include the consolidated bound check in vhost_vdpa.
Restrict access to /dev/vhost-vdpa-* device nodes to trusted virtualization services only.
Unload or blacklist the vdpa_sim module on systems that do not need vDPA simulation.

Patch Information

The fix is delivered through four upstream commits: Linux Kernel Commit 406db68, Linux Kernel Commit 7441d35, Linux Kernel Commit cd025c1, and Linux Kernel Commit ddb5735. The series moves the group bound check into vhost_vdpa and corrects the off-by-one in vdpa_sim.

Workarounds

Blacklist vdpa_sim by adding blacklist vdpa_sim to /etc/modprobe.d/ configuration on hosts that do not use it.
Apply strict file permissions on vhost-vdpa device nodes using udev rules to limit exposure to non-root users.
Isolate workloads requiring vDPA into dedicated hosts until kernels are patched across the fleet.

bash

# Configuration example: blacklist the vulnerable simulator module
echo 'blacklist vdpa_sim' | sudo tee /etc/modprobe.d/disable-vdpa-sim.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep -E 'vdpa_sim|vhost_vdpa'