Stack Buffer Overflow in Zephyr's Virtio PCI Driver

CVE-2026-13216

What is CVE-2026-13216?

The Virtio PCI driver in Zephyr OS has a vulnerability where unchecked lengths in the device's PCI capability list can lead to unbounded writes to a stack buffer during initialization. An attacker-controlled capability length may cause excessive data to be written beyond the allocated buffer size, potentially leading to kernel memory corruption, crashes, or remote code execution. The flaw particularly poses a risk in environments where virtio devices may not be fully trusted, especially in bare-metal systems or confidential computing contexts. A fix has been implemented to validate the capability length before processing to prevent such exploits.

References