Threats tagged 'ghsa-h9m6-p5f9-c339'

A vulnerability in the Linux kernel's vhost/vdpa subsystem allows a process with access to /dev/vhost-vdpa-* to configure a queue size larger than the device's maximum. This can lead to out-of-bounds reads in the vdpa_sim worker, potentially causing memory safety issues. The flaw arises because vhost_vring_set_num() accepts any non-zero power-of-two queue size without verifying it against the device's maximum queue size. The issue has been resolved by improving validation and caching mechanisms in the kernel.