kernel: vdpa_sim_blk: reject out-of-range sector starts

cve CVE-2026-97991 3 sources, 4 claims · Watch

Red Hat writes:
kernel: vdpa_sim_blk: reject out-of-range sector starts the claim

Severity they disagree: high GitHub advisories
HIGH NVD
moderate Red Hat
CVSS they disagree: 7.8 GitHub advisories
7.8 NVD
7 Red Hat
Vendor: Linux NVD
Product: Linux NVD
CWE: CWE-787 Red Hat

How far exploitation has got

No public code known
Proof of concept
Proof of concept, verified
A Metasploit module
Exploited in the wild
Used in ransomware campaigns

Why the CVSS differs

Metric	NVD	Red Hat
Attack vector AV	local L	local L
Attack complexity AC	high H	high H
Privileges required PR	low L	low L
User interaction UI	none N	none N
Scope S	changed C	unchanged U
Confidentiality C	high H	high H
Integrity I	high H	high H
Availability A	high H	high H

Each source scores the same vulnerability from what it judges the attack to need. The rows marked are where they judge it differently.

Timeline

2026-09-25	first spoke of it: In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of...	GitHub advisories
2026-09-25	first spoke of it: In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of-range sector starts vdpasim_blk_check_range() logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offset reach the data path. The invalid offset is used by three request paths. VIRTIO_BLK_T_OUT copies guest data to blk->buffer + offset through vringh_iov_pull_iotlb(), causing an out-of-bounds write in _copy_from_iter() or memcpy(). VIRTIO_BLK_T_IN copies from blk->buffer + offset to the guest through vringh_iov_push_iotlb(), causing an out-of-bounds read in _copy_to_iter(). VIRTIO_BLK_T_WRITE_ZEROES passes blk->buffer + offset to memset(), causing an out-of-bounds write. Reject starts at or beyond the capacity before the subtraction. Treat the capacity boundary as invalid because the IN and OUT paths round byte counts down to sectors for validation but later copy the original byte counts. A sub-sector request at the capacity boundary would otherwise still access past the end of the buffer. I found this bug myself, though the patch was written with AI assistance.	NVD
2026-09-25	first spoke of it: kernel: vdpa_sim_blk: reject out-of-range sector starts	Red Hat

What it is to other things

In words only, so not counted until a person confirms one:

affects	`linux/linux` NVD says “Linux · Linux”
made_by	`linux` NVD says “Linux”

Every value, with what each source said and its receipt

Property Source Said Means here

CVSS

cvss

conflict

GitHub advisories

7.8

receipt

Source: GitHub advisories
Said since: 2026-09-26 15:00 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

This source has not kept a receipt for this claim yet. The next update that reads it will.

—

CVSS

cvss

conflict

NVD

7.8

receipt

Source: NVD
Its words: 7.8
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "36ef4d8527f71648f00347f6ba759f0b7e5e0977",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "000c6300776ceaf6b715780113f4275b1be4195b",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "14acb0d44b7d90a077beb7b92b444b90bafda9d9",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "a8a1413a2cfdbedc896249f461d6d92efbbfe21f",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "0a8693f00c408d85f086ad85d29e7030bf1e2055",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.13"
              },
              {
                "lessThan": "5.13",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.222",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.158",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.111",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc3",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_blk: reject out-of-range sector starts\n\nvdpasim_blk_check_range() logs an invalid start sector but continues\nvalidating the request.  The subsequent unsigned capacity subtraction can\nunderflow and let an out-of-range buffer offset reach the data path.\n\nThe invalid offset is used by three request paths.  VIRTIO_BLK_T_OUT\ncopies guest data to blk->buffer + offset through\nvringh_iov_pull_iotlb(), causing an out-of-bounds write in\n_copy_from_iter() or memcpy().  VIRTIO_BLK_T_IN copies from\nblk->buffer + offset to the guest through vringh_iov_push_iotlb(),\ncausing an out-of-bounds read in _copy_to_iter().\nVIRTIO_BLK_T_WRITE_ZEROES passes blk->buffer + offset to memset(),\ncausing an out-of-bounds write.\n\nReject starts at or beyond the capacity before the subtraction.  Treat the\ncapacity boundary as invalid because the IN and OUT paths round byte counts\ndown to sectors for validation but later copy the original byte counts.  A\nsub-sector request at the capacity boundary would otherwise still access\npast the end of the buffer.\n\nI found this bug myself, though the patch was written with AI assistance."
      }
    ],
    "id": "CVE-2026-97991",
    "lastModified": "2026-10-03T11:18:22.853",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.1,
          "impactScore": 6.0,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-09-25T11:17:27.220",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/000c6300776ceaf6b715780113f4275b1be4195b"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/0a8693f00c408d85f086ad85d29e7030bf1e2055"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/14acb0d44b7d90a077beb7b92b444b90bafda9d9"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/36ef4d8527f71648f00347f6ba759f0b7e5e0977"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/a8a1413a2cfdbedc896249f461d6d92efbbfe21f"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Received"
  }
}

—

CVSS

cvss

conflict

Red Hat

receipt

Source: Red Hat
Its words: 7.0
Read by: field:cvss3_score
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-97991",
  "CWE": "CWE-787",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2541054",
  "bugzilla_description": "kernel: vdpa_sim_blk: reject out-of-range sector starts",
  "cvss3_score": "7.0",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-25T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-97991.json",
  "severity": "moderate"
}

—

CVSS vector

cvss_vector

not compared

NVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

receipt

Source: NVD
Its words: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "36ef4d8527f71648f00347f6ba759f0b7e5e0977",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "000c6300776ceaf6b715780113f4275b1be4195b",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "14acb0d44b7d90a077beb7b92b444b90bafda9d9",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "a8a1413a2cfdbedc896249f461d6d92efbbfe21f",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "0a8693f00c408d85f086ad85d29e7030bf1e2055",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.13"
              },
              {
                "lessThan": "5.13",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.222",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.158",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.111",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc3",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_blk: reject out-of-range sector starts\n\nvdpasim_blk_check_range() logs an invalid start sector but continues\nvalidating the request.  The subsequent unsigned capacity subtraction can\nunderflow and let an out-of-range buffer offset reach the data path.\n\nThe invalid offset is used by three request paths.  VIRTIO_BLK_T_OUT\ncopies guest data to blk->buffer + offset through\nvringh_iov_pull_iotlb(), causing an out-of-bounds write in\n_copy_from_iter() or memcpy().  VIRTIO_BLK_T_IN copies from\nblk->buffer + offset to the guest through vringh_iov_push_iotlb(),\ncausing an out-of-bounds read in _copy_to_iter().\nVIRTIO_BLK_T_WRITE_ZEROES passes blk->buffer + offset to memset(),\ncausing an out-of-bounds write.\n\nReject starts at or beyond the capacity before the subtraction.  Treat the\ncapacity boundary as invalid because the IN and OUT paths round byte counts\ndown to sectors for validation but later copy the original byte counts.  A\nsub-sector request at the capacity boundary would otherwise still access\npast the end of the buffer.\n\nI found this bug myself, though the patch was written with AI assistance."
      }
    ],
    "id": "CVE-2026-97991",
    "lastModified": "2026-10-03T11:18:22.853",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.1,
          "impactScore": 6.0,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-09-25T11:17:27.220",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/000c6300776ceaf6b715780113f4275b1be4195b"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/0a8693f00c408d85f086ad85d29e7030bf1e2055"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/14acb0d44b7d90a077beb7b92b444b90bafda9d9"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/36ef4d8527f71648f00347f6ba759f0b7e5e0977"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/a8a1413a2cfdbedc896249f461d6d92efbbfe21f"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Received"
  }
}

—

CVSS vector

cvss_vector

not compared

Red Hat

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

receipt

Source: Red Hat
Its words: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Read by: field:cvss3_scoring_vector
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-97991",
  "CWE": "CWE-787",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2541054",
  "bugzilla_description": "kernel: vdpa_sim_blk: reject out-of-range sector starts",
  "cvss3_score": "7.0",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-25T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-97991.json",
  "severity": "moderate"
}

—

CWE

cwe

Red Hat

CWE-787

receipt

Source: Red Hat
Its words: CWE-787
Read by: field:CWE
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-97991",
  "CWE": "CWE-787",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2541054",
  "bugzilla_description": "kernel: vdpa_sim_blk: reject out-of-range sector starts",
  "cvss3_score": "7.0",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-25T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-97991.json",
  "severity": "moderate"
}

—

Product

product

NVD

Linux

receipt

Source: NVD
Its words: Linux
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Linux
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "36ef4d8527f71648f00347f6ba759f0b7e5e0977",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "000c6300776ceaf6b715780113f4275b1be4195b",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "14acb0d44b7d90a077beb7b92b444b90bafda9d9",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "a8a1413a2cfdbedc896249f461d6d92efbbfe21f",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "0a8693f00c408d85f086ad85d29e7030bf1e2055",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.13"
              },
              {
                "lessThan": "5.13",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.222",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.158",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.111",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc3",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_blk: reject out-of-range sector starts\n\nvdpasim_blk_check_range() logs an invalid start sector but continues\nvalidating the request.  The subsequent unsigned capacity subtraction can\nunderflow and let an out-of-range buffer offset reach the data path.\n\nThe invalid offset is used by three request paths.  VIRTIO_BLK_T_OUT\ncopies guest data to blk->buffer + offset through\nvringh_iov_pull_iotlb(), causing an out-of-bounds write in\n_copy_from_iter() or memcpy().  VIRTIO_BLK_T_IN copies from\nblk->buffer + offset to the guest through vringh_iov_push_iotlb(),\ncausing an out-of-bounds read in _copy_to_iter().\nVIRTIO_BLK_T_WRITE_ZEROES passes blk->buffer + offset to memset(),\ncausing an out-of-bounds write.\n\nReject starts at or beyond the capacity before the subtraction.  Treat the\ncapacity boundary as invalid because the IN and OUT paths round byte counts\ndown to sectors for validation but later copy the original byte counts.  A\nsub-sector request at the capacity boundary would otherwise still access\npast the end of the buffer.\n\nI found this bug myself, though the patch was written with AI assistance."
      }
    ],
    "id": "CVE-2026-97991",
    "lastModified": "2026-10-03T11:18:22.853",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.1,
          "impactScore": 6.0,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-09-25T11:17:27.220",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/000c6300776ceaf6b715780113f4275b1be4195b"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/0a8693f00c408d85f086ad85d29e7030bf1e2055"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/14acb0d44b7d90a077beb7b92b444b90bafda9d9"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/36ef4d8527f71648f00347f6ba759f0b7e5e0977"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/a8a1413a2cfdbedc896249f461d6d92efbbfe21f"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Received"
  }
}

—

Severity

severity

conflict

GitHub advisories

high

From 7.0 to 8.9.

receipt

Source: GitHub advisories
Said since: 2026-09-26 15:00 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

This source has not kept a receipt for this claim yet. The next update that reads it will.

—

Severity

severity

conflict

NVD

HIGH

From 7.0 to 8.9.

receipt

Source: NVD
Its words: HIGH
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	HIGH
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "36ef4d8527f71648f00347f6ba759f0b7e5e0977",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "000c6300776ceaf6b715780113f4275b1be4195b",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "14acb0d44b7d90a077beb7b92b444b90bafda9d9",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "a8a1413a2cfdbedc896249f461d6d92efbbfe21f",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "0a8693f00c408d85f086ad85d29e7030bf1e2055",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.13"
              },
              {
                "lessThan": "5.13",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.222",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.158",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.111",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc3",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_blk: reject out-of-range sector starts\n\nvdpasim_blk_check_range() logs an invalid start sector but continues\nvalidating the request.  The subsequent unsigned capacity subtraction can\nunderflow and let an out-of-range buffer offset reach the data path.\n\nThe invalid offset is used by three request paths.  VIRTIO_BLK_T_OUT\ncopies guest data to blk->buffer + offset through\nvringh_iov_pull_iotlb(), causing an out-of-bounds write in\n_copy_from_iter() or memcpy().  VIRTIO_BLK_T_IN copies from\nblk->buffer + offset to the guest through vringh_iov_push_iotlb(),\ncausing an out-of-bounds read in _copy_to_iter().\nVIRTIO_BLK_T_WRITE_ZEROES passes blk->buffer + offset to memset(),\ncausing an out-of-bounds write.\n\nReject starts at or beyond the capacity before the subtraction.  Treat the\ncapacity boundary as invalid because the IN and OUT paths round byte counts\ndown to sectors for validation but later copy the original byte counts.  A\nsub-sector request at the capacity boundary would otherwise still access\npast the end of the buffer.\n\nI found this bug myself, though the patch was written with AI assistance."
      }
    ],
    "id": "CVE-2026-97991",
    "lastModified": "2026-10-03T11:18:22.853",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.1,
          "impactScore": 6.0,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-09-25T11:17:27.220",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/000c6300776ceaf6b715780113f4275b1be4195b"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/0a8693f00c408d85f086ad85d29e7030bf1e2055"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/14acb0d44b7d90a077beb7b92b444b90bafda9d9"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/36ef4d8527f71648f00347f6ba759f0b7e5e0977"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/a8a1413a2cfdbedc896249f461d6d92efbbfe21f"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Received"
  }
}

high

Severity

severity

conflict

Red Hat

moderate

A flaw that is harder to exploit, or whose impact is limited.

receipt

Source: Red Hat
Its words: moderate
Read by: field:severity
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-97991",
  "CWE": "CWE-787",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2541054",
  "bugzilla_description": "kernel: vdpa_sim_blk: reject out-of-range sector starts",
  "cvss3_score": "7.0",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-25T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-97991.json",
  "severity": "moderate"
}

medium

Status

status

NVD

Received

receipt

Source: NVD
Its words: Received
Read by: field:cve.vulnStatus
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "36ef4d8527f71648f00347f6ba759f0b7e5e0977",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "000c6300776ceaf6b715780113f4275b1be4195b",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "14acb0d44b7d90a077beb7b92b444b90bafda9d9",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "a8a1413a2cfdbedc896249f461d6d92efbbfe21f",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "0a8693f00c408d85f086ad85d29e7030bf1e2055",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.13"
              },
              {
                "lessThan": "5.13",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.222",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.158",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.111",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc3",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_blk: reject out-of-range sector starts\n\nvdpasim_blk_check_range() logs an invalid start sector but continues\nvalidating the request.  The subsequent unsigned capacity subtraction can\nunderflow and let an out-of-range buffer offset reach the data path.\n\nThe invalid offset is used by three request paths.  VIRTIO_BLK_T_OUT\ncopies guest data to blk->buffer + offset through\nvringh_iov_pull_iotlb(), causing an out-of-bounds write in\n_copy_from_iter() or memcpy().  VIRTIO_BLK_T_IN copies from\nblk->buffer + offset to the guest through vringh_iov_push_iotlb(),\ncausing an out-of-bounds read in _copy_to_iter().\nVIRTIO_BLK_T_WRITE_ZEROES passes blk->buffer + offset to memset(),\ncausing an out-of-bounds write.\n\nReject starts at or beyond the capacity before the subtraction.  Treat the\ncapacity boundary as invalid because the IN and OUT paths round byte counts\ndown to sectors for validation but later copy the original byte counts.  A\nsub-sector request at the capacity boundary would otherwise still access\npast the end of the buffer.\n\nI found this bug myself, though the patch was written with AI assistance."
      }
    ],
    "id": "CVE-2026-97991",
    "lastModified": "2026-10-03T11:18:22.853",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.1,
          "impactScore": 6.0,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-09-25T11:17:27.220",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/000c6300776ceaf6b715780113f4275b1be4195b"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/0a8693f00c408d85f086ad85d29e7030bf1e2055"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/14acb0d44b7d90a077beb7b92b444b90bafda9d9"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/36ef4d8527f71648f00347f6ba759f0b7e5e0977"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/a8a1413a2cfdbedc896249f461d6d92efbbfe21f"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Received"
  }
}

—

Vendor

vendor

NVD

Linux

receipt

Source: NVD
Its words: Linux
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Linux
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "36ef4d8527f71648f00347f6ba759f0b7e5e0977",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "000c6300776ceaf6b715780113f4275b1be4195b",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "14acb0d44b7d90a077beb7b92b444b90bafda9d9",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "a8a1413a2cfdbedc896249f461d6d92efbbfe21f",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              },
              {
                "lessThan": "0a8693f00c408d85f086ad85d29e7030bf1e2055",
                "status": "affected",
                "version": "7d189f617f83f780915b737896a696ff605bd19f",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "drivers/vdpa/vdpa_sim/vdpa_sim_blk.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.13"
              },
              {
                "lessThan": "5.13",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.222",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.1.*",
                "status": "unaffected",
                "version": "6.1.189",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.158",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.111",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc3",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa_sim_blk: reject out-of-range sector starts\n\nvdpasim_blk_check_range() logs an invalid start sector but continues\nvalidating the request.  The subsequent unsigned capacity subtraction can\nunderflow and let an out-of-range buffer offset reach the data path.\n\nThe invalid offset is used by three request paths.  VIRTIO_BLK_T_OUT\ncopies guest data to blk->buffer + offset through\nvringh_iov_pull_iotlb(), causing an out-of-bounds write in\n_copy_from_iter() or memcpy().  VIRTIO_BLK_T_IN copies from\nblk->buffer + offset to the guest through vringh_iov_push_iotlb(),\ncausing an out-of-bounds read in _copy_to_iter().\nVIRTIO_BLK_T_WRITE_ZEROES passes blk->buffer + offset to memset(),\ncausing an out-of-bounds write.\n\nReject starts at or beyond the capacity before the subtraction.  Treat the\ncapacity boundary as invalid because the IN and OUT paths round byte counts\ndown to sectors for validation but later copy the original byte counts.  A\nsub-sector request at the capacity boundary would otherwise still access\npast the end of the buffer.\n\nI found this bug myself, though the patch was written with AI assistance."
      }
    ],
    "id": "CVE-2026-97991",
    "lastModified": "2026-10-03T11:18:22.853",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.1,
          "impactScore": 6.0,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-09-25T11:17:27.220",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/000c6300776ceaf6b715780113f4275b1be4195b"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/0a8693f00c408d85f086ad85d29e7030bf1e2055"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/14acb0d44b7d90a077beb7b92b444b90bafda9d9"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/2ff2a8d063fdfa1e1479fb1fe2e3356a2ce89018"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/36ef4d8527f71648f00347f6ba759f0b7e5e0977"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/a8a1413a2cfdbedc896249f461d6d92efbbfe21f"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/d6dac17e20fd2abd0eb8c09d69fccf7426e12bcf"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Received"
  }
}

—

Every claim, by kind

vulnerability

kernel: vdpa_sim_blk: reject out-of-range sector starts zetlyn/cve-redhat · 2026-09-25	cvss 7 cvss_vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H cwe CWE-787 severity moderate	source
In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of-range sector starts vdpasim_blk_check_range() logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offset reach the data path. The invalid offset is used by three request paths. VIRTIO_BLK_T_OUT copies guest data to blk->buffer + offset through vringh_iov_pull_iotlb(), causing an out-of-bounds write in _copy_from_iter() or memcpy(). VIRTIO_BLK_T_IN copies from blk->buffer + offset to the guest through vringh_iov_push_iotlb(), causing an out-of-bounds read in _copy_to_iter(). VIRTIO_BLK_T_WRITE_ZEROES passes blk->buffer + offset to memset(), causing an out-of-bounds write. Reject starts at or beyond the capacity before the subtraction. Treat the capacity boundary as invalid because the IN and OUT paths round byte counts down to sectors for validation but later copy the original byte counts. A sub-sector request at the capacity boundary would otherwise still access past the end of the buffer. I found this bug myself, though the patch was written with AI assistance. zetlyn/cve-nvd · 2026-09-25	cvss 7.8 cvss_vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H product Linux severity HIGH status Received vendor Linux	source
In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of... zetlyn/cve-ghsa · 2026-09-25	cvss 7.8 severity high	source
In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of... zetlyn/cve-ghsa · 2026-09-25	cvss 7.8 severity high	source