CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa
In the Linux kernel, the following vulnerability has been resolved:
vhost: move vdpa group bound check to vhostvdpa
Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them.
While we're at it, fix a bug in vdpasim where a valid ASID can be assigned to a group equal to ngroups, causing an out of bound write.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43248?
CVE-2026-43248 has a medium severity rating due to the potential impact on system stability and security.
How do I fix CVE-2026-43248?
To fix CVE-2026-43248, update your Linux kernel to the latest stable version that includes the patch for this vulnerability.
What types of systems are affected by CVE-2026-43248?
CVE-2026-43248 affects the Linux kernel, particularly systems utilizing the vhost and vdpa components.
What are the potential impacts of CVE-2026-43248?
The potential impacts of CVE-2026-43248 include system crashes and possible data corruption due to improper group bounds checking.
Is CVE-2026-43248 currently being exploited in the wild?
As of now, there is no evidence that CVE-2026-43248 is actively being exploited in the wild.