CVE-2026-5164
A flaw was found in virtio-win.
Published Mar 30, 2026 · updated Jun 17, 2026 · redhat virtio-win
A flaw was found in virtio-win. The function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 30, 2026 · NIST NVD
Detected
A flaw was found in virtio-win. The function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).
Jun 17, 2026 · NIST NVD
Updated
A flaw was found in virtio-win. The function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).
Affected
- cpe redhat/enterprise linux10.0
- cpe redhat/enterprise linux9.0
- cpe redhat/virtio-winversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-5164
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-5164
A flaw was found in virtio-win. The function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to
nvd.nist.gov