CVE-2026-5165: Virtio-win: virtio-win: memory corruption via use-after-free in virtio blk device reset
A flaw was found in virtio-win, specifically within the VirtIO Block (BLK) device. When the device undergoes a reset, it fails to properly manage memory, resulting in a use-after-free vulnerability. This issue could allow a local attacker to corrupt system memory, potentially leading to system instability or unexpected behavior.
Other sources
The VirtIO BLK device does not have special reset events/routines like the VirtIO SCSI device (controlq command VIRTIOSCSITTMFLOGICALUNITRESET), but Windows requires to have some mechanism to fix a device when it hangs. The most appropriate way is perform a full VirtIO reset and initialization flow based on spec.
The following flow is implemented:
Reset VirtIO device (virtiodevicereset) Delete VirtIO queues (virtiodeletequeues) Clean up all device memory (virtiodeviceshutdown) Complete all pending SRBs (in guest, CompletePendingRequestsOnReset) Perform VirtIO device initialization (virtiodeviceinitialize, virtiofindqueues, etc) Note: We don't pause StorPort because the port driver pauses all device IO queues for the adapter and then calls the HwStorResetBus routine https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/storport/nc-storport-hwresetbus
Note: We cannot just complete all pending SRBs and continue, because this memory will be still in use by the device and free in Windows. As a result, we got use-after-free when the device completes the request and sends it back to Windows. This may cause a memory corruption, as Windows may already have reused the memory.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5165?
CVE-2026-5165 has been classified with a moderate severity level due to potential memory corruption issues.
How do I fix CVE-2026-5165?
To address CVE-2026-5165, you should update to the latest version of virtio-win that includes the patch for the vulnerability.
What is the impact of CVE-2026-5165?
CVE-2026-5165 can lead to memory corruption and may cause instability or crashes in systems using the VirtIO Block device.
Is CVE-2026-5165 exploitable remotely?
CVE-2026-5165 is considered a local vulnerability that requires access to the affected system for exploitation.
What software is affected by CVE-2026-5165?
The vulnerability impacts the virtio-win software specifically related to the VirtIO Block device functionality.