CVE-2026-46655

Overview

A local integer overflow vulnerability exists in the virtio-win Viosock driver for Windows guests running on QEMU and KVM. A low-privilege local user can supply specially crafted inputs via IOCTL_SELECT to cause kernel heap memory corruption. This issue matters because it enables local privilege escalation within the guest operating system.

Description

virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_SELECT request with attacker-controlled VIRTIO_VSOCK_SELECT.Fdss[*].fd_count values that overflow the 32-bit sum used by VIOSockSelect for bounds checking. The wrapped sum can pass the FD_SETSIZE check even though an individual descriptor count is much larger than the expected limit. VIOSockSelectCopyFds then iterates using the unchecked count and writes beyond the allocated pPkt->Fds array in the NonPagedPool kernel heap. Successful exploitation can corrupt kernel memory and enable privilege escalation in a Windows guest running the driver. This issue is fixed in mm320.

Impact

The vulnerability impacts the confidentiality, integrity, and availability of the Windows guest operating system. Successful exploitation allows a low-privileged local attacker to corrupt kernel memory within the NonPagedPool and achieve privilege escalation. This affects virtualized environments utilizing QEMU and KVM with vulnerable paravirtualized drivers.

Remediation

Upgrade the virtio-win package to version mm320 or later where the integer overflow and bounds checking issues are resolved. Apply vendor-supplied updates promptly to affected Windows guest environments. Restrict local access and monitor endpoint activity for suspicious privilege escalation attempts.

Risk context

The vulnerability is rated with a CVSS v3 score of 7.8, categorizing it as high severity. EPSS data is currently unavailable. The urgency is moderate-to-high for environments hosting untrusted local users inside virtual machines running vulnerable driver versions.

Affected products

• Red Hat virtio-win (mm210 to mm319)