CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths
In the Linux kernel, the following vulnerability has been resolved:
vhost/vdpa: validate virtqueue index in mmap and fault paths
vhostvdpammap() and vhostvdpafault() use vma->vmpgoff as a virtqueue index for getvqnotification(), but they do not validate that the index is smaller than v->nvqs.
The ioctl path already performs both a bounds check and arrayindexnospec(), but the mmap/fault path only checks that the index fits in u16. This allows an out-of-range queue index to reach driver-specific getvqnotification() callbacks.
Fix this by extracting a unified vhostvdpagetvqnotification() helper that validates the queue index against v->nvqs and applies arrayindexnospec() before calling the driver callback. Both the mmap and fault paths use this helper, and the bounds checking is consolidated into a single location.
From source inspection, the most defensible impact is out-of-bounds access in the callback path, potentially leading to invalid PFN remaps and crash/DoS.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the kernel vhost/vdpa fix that validates the virtqueue index in the mmap and fault paths (the resolution is to consolidate this into unified vhost_vdpa_get_vq_notification() that checks the index against v->nvqs and ensures it fits in u16), to prevent out-of-bounds access in the callback path that can lead to remaps and crash/DoS.