Virtio Driver Vulnerability in Zephyr RTOS by Zephyr Project

CVE-2026-13212

What is CVE-2026-13212?

The Zephyr RTOS virtio driver fails to properly validate the descriptor-chain head ID written by the virtio device into the used ring. This lack of validation allows a malicious or compromised virtio backend to provide an ID that exceeds the allocated entries, leading to an out-of-bounds read of memory beyond the defined bounds. Consequently, this can trigger an arbitrary function-pointer call within the guest context, creating a pathway for control-flow hijacking and potential code execution. The issue has been addressed by implementing checks to ensure that any used-ring ID is within valid limits prior to invoking callback functions.

References