CVE-2026-13212

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The virtio driver fails to validate the descriptor-chain head id written by the virtio device into the used ring. In the virtio isr() function (drivers/virtio/virtio common.c), the vq->used->ring[idx].id value is used as an index for vq->recv cbs[] and vq->desc[] without bound checks. A compromised virtio backend, such as an untrusted hypervisor or hardware device on PCI or MMIO transport, can provide an id exceeding vq->num. This leads to an out-of-bounds read of a function pointer and argument from heap memory, allowing the backend to trigger an arbitrary function-pointer call in the guest's interrupt context. This control-flow-hijack primitive can result in arbitrary code execution or a system crash. This issue specifically affects builds using CONFIG VIRTIO with PCI or MMIO transport.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.