CVE-2026-46655: virtio-win Privilege Escalation Vulnerability

CVE-2026-46655 Overview

CVE-2026-46655 is a heap-based buffer overflow [CWE-122] in the Viosock driver shipped with virtio-win, the paravirtualized Windows driver package for QEMU and KVM. The flaw lets a low-privilege local process in a Windows guest submit a crafted IOCTL_SELECT request that overflows a 32-bit sum used for bounds checking in VIOSockSelect. The wrapped value bypasses the FD_SETSIZE check, causing VIOSockSelectCopyFds to write past the allocated pPkt->Fds array in the NonPagedPool kernel heap. Successful exploitation corrupts kernel memory and enables privilege escalation inside the guest. Affected releases span mm210 through versions prior to mm320.

Critical Impact
A local, low-privileged user in a Windows VM running vulnerable virtio-win drivers can corrupt kernel memory and escalate to SYSTEM.

Affected Products

virtio-win kvm-guest-drivers-windows Viosock driver, versions mm210 through releases prior to mm320
Windows guests running on QEMU/KVM hypervisors with the vulnerable Viosock driver installed
Fixed in release mm320

Discovery Timeline

2026-09-18 - CVE-2026-46655 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-46655

Vulnerability Analysis

The Viosock driver exposes an IOCTL_SELECT interface that accepts a VIRTIO_VSOCK_SELECT structure containing three Fdss[*] file descriptor sets (read, write, exception). Each set carries an attacker-controlled fd_count field. VIOSockSelect sums these counts into a 32-bit variable and compares the total against FD_SETSIZE to reject oversized requests.

Because the sum is stored in a 32-bit unsigned integer without saturation, values close to ULONG_MAX wrap around during addition. A wrapped total can be small enough to satisfy the FD_SETSIZE bounds check even when an individual fd_count is enormous. The driver then allocates pPkt->Fds based on the (attacker-influenced) accepted size and passes the request to VIOSockSelectCopyFds, which iterates using the unvalidated per-set fd_count. The loop writes descriptors past the end of the allocation into adjacent NonPagedPool chunks.

Root Cause

The root cause is missing overflow validation on the aggregate descriptor count. The 32-bit addition of fdRead, fdWrite, and fdExcpt can wrap, and neither individual counts nor the total are re-validated before VIOSockSelectCopyFds uses them as loop bounds. This is a classic integer-overflow-leading-to-heap-overflow pattern.

Attack Vector

Exploitation requires local code execution as a low-privileged user inside the Windows guest. The attacker opens the Viosock device and issues a crafted DeviceIoControl call with IOCTL_SELECT, supplying fd_count values chosen to wrap the 32-bit sum. Kernel heap corruption in NonPagedPool can then be shaped into arbitrary write primitives and privilege escalation within the guest. The bug is not remotely reachable and does not cross the guest/host boundary.

     BOOLEAN bIs32BitProcess = FALSE;
     WDF_OBJECT_ATTRIBUTES Attributes;
     PVIOSOCK_SELECT_PKT pPkt = NULL;
+    ULONG fdRead, fdWrite, fdExcpt, uTotalFdCount;
 
     PAGED_CODE();

Source: virtio-win kvm-guest-drivers-windows commit c6bef93. The patch introduces explicit per-set variables and a total that are validated against overflow and against FD_SETSIZE before any allocation or copy.

Detection Methods for CVE-2026-46655

Indicators of Compromise

Unexpected bugchecks originating in viosock.sys, particularly BAD_POOL_HEADER (0x19), KERNEL_MODE_HEAP_CORRUPTION (0x13A), or SYSTEM_SERVICE_EXCEPTION (0x3B) with viosock in the stack.
Non-administrator processes opening handles to the Viosock device and issuing IOCTL_SELECT with unusually large fd_count values.
New SYSTEM-integrity processes spawned shortly after Viosock IOCTL activity from a standard user session.

Detection Strategies

Inventory Windows guests running virtio-win and flag any Viosock driver version between mm210 and versions prior to mm320.
Enable Driver Verifier with special pool on viosock.sys in test environments to surface out-of-bounds writes during triage.
Correlate kernel crash dumps referencing VIOSockSelect or VIOSockSelectCopyFds with local privilege escalation telemetry.

Monitoring Recommendations

Monitor Windows Error Reporting and kernel minidump submissions for repeated crashes in viosock.sys.
Track token elevation events (Sysmon Event ID 1 with parent context, Security 4672) issued by processes whose parent was a standard user shell.
Alert on unsigned or unexpected drivers loading alongside virtio-win in guest VMs.

How to Mitigate CVE-2026-46655

Immediate Actions Required

Upgrade the virtio-win Viosock driver to release mm320 or later on every affected Windows guest.
Identify guest VMs where Viosock functionality is unused and remove or disable the driver until patched.
Restrict local user access on high-value Windows guests to reduce the population that can reach the IOCTL surface.

Patch Information

The fix is delivered in the virtio-win release mm320 via Pull Request #1568 and commit c6bef93. Details are documented in GHSA-qrhp-4mhp-hjwh. The patch adds explicit per-set counters and validates the total against integer overflow and FD_SETSIZE before allocation.

Workarounds

If patching is not immediately possible, unload or disable viosock.sys in guests that do not require VM socket functionality.
Apply application allowlisting to prevent untrusted binaries from executing in guest user sessions, reducing the ability to invoke the vulnerable IOCTL.
Use hypervisor policy to withhold the Viosock virtio device from guests that do not need it.

bash

# Query the installed Viosock driver version on a Windows guest
sc.exe query viosock
pnputil /enum-drivers | findstr /i viosock

# Disable the Viosock service until patched (requires reboot)
sc.exe config viosock start= disabled