CVE-2026-13216: bounds in zephyrproject zephyr

The virtio PCI driver in Zephyr parses PCI capability lists during initialization. The device-supplied capability length byte (cap_len) was only validated by an assert that is disabled in production, allowing invalid lengths to pass unchecked. This leads to out-of-bounds writes on the kernel stack when copying capability data, either by underflowing to a large value or by exceeding the caller's buffer size. The input originates from the virtio device, so exploitation requires an untrusted or malicious virtio PCIe device. In typical guest deployments under a hypervisor, this does not lead to privilege escalation since the host controls the device. However, on bare-metal or confidential computing setups with untrusted devices, this can cause kernel corruption and potential code execution or crashes. The patch introduces a runtime range check on cap_len to prevent invalid values before any copy operations.

The vulnerability allows an attacker controlling a virtio PCIe device to cause out-of-bounds stack writes in the Zephyr kernel during device initialization. This can lead to kernel stack corruption, potential code execution, or system crashes. There is no confidentiality impact. In typical virtualized environments where Zephyr runs as a guest, the host controls the device and thus no privilege escalation is possible. The impact is significant in bare-metal or confidential computing environments where the device is untrusted relative to the kernel.

A fix is available that replaces the disabled assert with a runtime range check validating the capability length before copying data. Users should upgrade to Zephyr version 4.4.2 or later, where this fix is included. Until patched, avoid exposing Zephyr to untrusted virtio PCIe devices, especially in bare-metal or confidential computing scenarios.