CVE-2026-46655: virtio-win: Integer overflow causing a heap overflow in Viosock driver
virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTLSELECT request with attacker-controlled VIRTIOVSOCKSELECT.Fdss[].fdcount values that overflow the 32-bit sum used by VIOSockSelect for bounds checking. The wrapped sum can pass the FDSETSIZE check even though an individual descriptor count is much larger than the expected limit. VIOSockSelectCopyFds then iterates using the unchecked count and writes beyond the allocated pPkt->Fds array in the NonPagedPool kernel heap. Successful exploitation can corrupt kernel memory and enable privilege escalation in a Windows guest running the driver. This issue is fixed in mm320.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
virtio-win (Viosock driver)to a version that resolves this vulnerability.Fixed in mm320
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Windows guest systems running the virtio-win Viosock driver are exposed if they use a release from mm210 through versions before mm320. The issue is fixed in mm320.
What access does an attacker need to exploit it?
An attacker needs the ability to run a low-privilege process locally in the affected Windows guest. They can submit a crafted IOCTL_SELECT request with attacker-controlled descriptor-count values.
What is the likely impact of successful exploitation?
Successful exploitation writes beyond a NonPagedPool kernel-heap allocation, corrupting kernel memory. This can enable privilege escalation within the Windows guest.
How can administrators determine whether they are affected?
Determine whether the Windows guest has the virtio-win Viosock driver installed and identify its virtio-win release. Releases from mm210 through versions earlier than mm320 are affected.