CVE-2026-13216

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The virtio PCI driver in drivers/virtio/virtio pci.c contains an out-of-bounds write issue during driver initialization. The virtio pci read cap() function fails to properly validate the cap len variable read from the PCI configuration space via pcie conf read(). Because the validation relied on an assertion that is disabled in production builds, the cap len value is used to drive a loop that copies data into a fixed-size stack buffer.

If cap len is smaller than the 24-byte base structure virtio pci cap, an unsigned underflow occurs in the extra data words count, leading to an unbounded stack write. Conversely, a cap len value exceeding the buffer size (up to 255) allows up to approximately 228 bytes of device-controlled data to be written past the buffer. This can be exploited by an untrusted physical or passthrough virtio PCIe device to corrupt the kernel stack, potentially resulting in a system crash or arbitrary code execution in kernel mode during the boot-time device probe.

Recommendations As a temporary mitigation, restrict the use of untrusted or physical passthrough virtio PCIe devices on the system until the software is updated to include the runtime range check for cap len in the virtio pci read cap() function.