The Linux kernel's virtio-rng driver stored the device-reported used.len value directly without validating it against the buffer size, leading to an out-of-bounds read in copy_data(). A malicious or buggy virtio-rng backend could set used.len beyond the size of the internal data buffer, causing memcpy() to read past the buffer into adjacent kmalloc slab memory. This memory is then mixed into the guest RNG output and can be directly read by guest root via /dev/hwrng. This creates a memory safety issue and a potential cross-boundary information leak in confidential compute environments. The vulnerability was confirmed by KASAN testing and fixed by clamping the used.len value and adding array_index_nospec() to prevent speculative out-of-bounds access.

The vulnerability allows a malicious or buggy virtio-rng backend to cause an out-of-bounds read of guest kernel memory, contaminating the guest's random number generator output with adjacent slab data. In confidential compute scenarios, a malicious hypervisor combined with compromised guest root can use this to leak guest kernel heap contents. The issue compromises memory safety and can lead to information disclosure within the guest. However, many confidential compute guests disable virtio-rng, limiting the attack surface. No known exploits are reported in the wild.

A fix is available that clamps the device-reported used.len at the point of use and applies array_index_nospec() to prevent out-of-bounds access. Users should apply the official Linux kernel patches that address this issue. Since this is a kernel vulnerability, upgrading to a patched kernel version is the recommended remediation. No additional mitigation is required if the kernel is updated. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.