UBUNTU-CVE-2026-72380: High severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response reqid before indexing rsp[] pvcallsfronteventhandler() takes reqid directly from the backend-supplied ring response and uses it to index the fixed-size bedata->rsp[] array for a memcpy() and a store, with no range check. A malicious or buggy backend can set reqid past PVCALLSNRRSPPERRING and drive an out-of-bounds write past the bedata allocation. reqid was also declared int while the wire field rsp->reqid is u32, so a range check on the signed value alone is insufficient: a backend reqid of 0xffffffff becomes -1, passes a >= PVCALLSNRRSPPERRING test and indexes bedata->rsp[-1]. Declare reqid as u32 so a single bound covers both ends. A backend that sends an out-of-range reqid has violated the wire protocol, so rather than silently dropping the response, log once and stop trusting the backend: set bedata->disabled. The event handler then ignores further responses, and the request paths that wait for a response return -EIO instead of blocking forever. This mirrors the fatal-error handling xen-netback uses (xenviffataltxerr()). The pvcalls frontend currently trusts its backend, so this is not a classic-Xen security issue, but it matters for hardening PV frontends against malicious backends (confidential and disaggregated deployments).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1035.38 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In xen/pvcalls_front_event_handler(), declare req_id as u32 and validate it against PVCALLS_NR_RSP_PER_RING before indexing bedata->rsp[]. If it is out of range, log the violation once, set bedata->disabled, ignore further responses, and make request paths waiting for a response return -EIO.
Event History
Frequently Asked Questions
Who can trigger this issue?
A malicious or buggy Xen pvcalls backend can trigger it by supplying an out-of-range response request ID. The vulnerable frontend uses that backend-controlled value to index a fixed-size response array.
What is the security impact of a successful trigger?
An out-of-range request ID can cause an out-of-bounds write beyond the frontend's bedata allocation. The reported severity vector indicates high impact to confidentiality, integrity, and availability.
How does the resolved code handle an invalid backend response?
It treats an out-of-range request ID as a fatal backend protocol error, logs it once, and disables trust in that backend. Further responses are ignored, and request paths waiting for responses return -EIO rather than blocking indefinitely.
Which Ubuntu kernel package families are identified for this CVE?
The affected software list includes ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp-fips, ubuntu/linux-gcp, and ubuntu/linux-oracle.