A flaw was found in virtio-win. The `RhelDoUnMap()` function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).
CVE-2026-5164
CVSS base score
6.7 (v3.1)
Severity
MEDIUM
Attack vector
Local
Weakness
CWE-120
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
redhat virtio-win
redhat enterprise linux
References
- access.redhat.com Vendor Advisory
- bugzilla.redhat.com Issue Tracking, Vendor Advisory
- github.com Issue Tracking, Patch