CVE-2026-64456

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1-rc4

Description An out-of-bounds read issue exists in the virtio-rng driver. The random recv done() function stores a device-reported used.len value into vi->data avail without validation. Subsequently, the copy data() function uses vi->data idx to index the vi->data[] array and performs a memcpy() without verifying if the values exceed the buffer size of vi->data. A malicious or buggy virtio-rng backend can provide a used.len value larger than the buffer, causing the driver to read adjacent kmalloc-1k slab bytes. This can lead to the contamination of the guest Random Number Generator (RNG) via the hwrng fillfn() function or allow a guest root user to leak guest-kernel heap data through the /dev/hwrng endpoint.

Recommendations Update the Linux kernel to version 7.1-rc4 or later. As a temporary mitigation, disable the virtio-rng device to prevent the out-of-bounds read.