{"document":{"aggregate_severity":{"namespace":"https://access.redhat.com/security/updates/classification/","text":"Important"},"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"text":"Copyright © Red Hat, Inc. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"An update for virtio-win is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.","title":"Topic"},{"category":"general","text":"The virtio-win package provides paravirtualized network drivers for most Microsoft Windows operating systems. Paravirtualized drivers are virtualization-aware drivers used by fully virtualized guests running on Red Hat Enterprise Linux. Fully virtualized guests using the paravirtualized drivers gain significantly better I/O performance than fully virtualized guests running without the drivers.","title":"Details"},{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.","title":"Terms of Use"}],"publisher":{"category":"vendor","contact_details":"https://access.redhat.com/security/team/contact/","issuing_authority":"Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.","name":"Red Hat Product Security","namespace":"https://www.redhat.com"},"references":[{"category":"self","summary":"https://access.redhat.com/errata/RHBA-2026:65127","url":"https://access.redhat.com/errata/RHBA-2026:65127"},{"category":"self","summary":"Canonical URL","url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhba-2026_65127.json"}],"title":"Red Hat Bug Fix Advisory: virtio-win  update","tracking":{"current_release_date":"2026-11-04T12:51:06+00:00","generator":{"date":"2026-11-04T12:51:06+00:00","engine":{"name":"Red Hat SDEngine","version":"5.4.4"}},"id":"RHBA-2026:65127","initial_release_date":"2026-09-08T09:03:27+00:00","revision_history":[{"date":"2026-09-08T09:03:27+00:00","number":"1","summary":"Initial version"},{"date":"2026-09-08T09:03:27+00:00","number":"2","summary":"Last updated version"},{"date":"2026-11-04T12:51:06+00:00","number":"3","summary":"Last generated version"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux AppStream E4S (v.9.2)","product":{"name":"Red Hat Enterprise Linux AppStream E4S (v.9.2)","product_id":"AppStream-9.2.0.Z.E4S","product_identification_helper":{"cpe":"cpe:/a:redhat:rhel_e4s:9.2::appstream"}}}],"category":"product_family","name":"Red Hat Enterprise Linux"},{"branches":[{"category":"product_version","name":"virtio-win-0:1.9.58-0.el9_2.src","product":{"name":"virtio-win-0:1.9.58-0.el9_2.src","product_id":"virtio-win-0:1.9.58-0.el9_2.src","product_identification_helper":{"purl":"pkg:rpm/redhat/virtio-win@1.9.58-0.el9_2?arch=src"}}}],"category":"architecture","name":"src"},{"branches":[{"category":"product_version","name":"virtio-win-0:1.9.58-0.el9_2.noarch","product":{"name":"virtio-win-0:1.9.58-0.el9_2.noarch","product_id":"virtio-win-0:1.9.58-0.el9_2.noarch","product_identification_helper":{"purl":"pkg:rpm/redhat/virtio-win@1.9.58-0.el9_2?arch=noarch"}}}],"category":"architecture","name":"noarch"}],"category":"vendor","name":"Red Hat"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"virtio-win-0:1.9.58-0.el9_2.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)","product_id":"AppStream-9.2.0.Z.E4S:virtio-win-0:1.9.58-0.el9_2.noarch"},"product_reference":"virtio-win-0:1.9.58-0.el9_2.noarch","relates_to_product_reference":"AppStream-9.2.0.Z.E4S"},{"category":"default_component_of","full_product_name":{"name":"virtio-win-0:1.9.58-0.el9_2.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)","product_id":"AppStream-9.2.0.Z.E4S:virtio-win-0:1.9.58-0.el9_2.src"},"product_reference":"virtio-win-0:1.9.58-0.el9_2.src","relates_to_product_reference":"AppStream-9.2.0.Z.E4S"}]},"vulnerabilities":[{"cve":"CVE-2026-46655","cwe":{"id":"CWE-190","name":"Integer Overflow or Wraparound"},"discovery_date":"2026-06-16T00:00:00+00:00","ids":[{"system_name":"Red Hat Bugzilla ID","text":"2489170"}],"notes":[{"category":"description","text":"A flaw was found in virtio-win. A low-integrity process can issue an IOCTL request to viosock.sys!VIOSockSelect with a maliciously crafted request that causes an integer overflow. This allows the process to circumvent bounds checking, resulting in a heap overflow in the NonPagedPool kernel heap. The flaw could be exploited to escalate privileges on Windows systems running this driver.","title":"Vulnerability description"},{"category":"summary","text":"virtio-win: viosock.sys: integer overflow in VIOSockSelect leads to heap-based buffer overflow","title":"Vulnerability summary"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"fixed":["AppStream-9.2.0.Z.E4S:virtio-win-0:1.9.58-0.el9_2.noarch","AppStream-9.2.0.Z.E4S:virtio-win-0:1.9.58-0.el9_2.src"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-46655"},{"category":"external","summary":"RHBZ#2489170","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489170"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-46655","url":"https://www.cve.org/CVERecord?id=CVE-2026-46655"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2026-46655","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46655"},{"category":"external","summary":"https://github.com/virtio-win/kvm-guest-drivers-windows/security/advisories/GHSA-qrhp-4mhp-hjwh","url":"https://github.com/virtio-win/kvm-guest-drivers-windows/security/advisories/GHSA-qrhp-4mhp-hjwh"}],"release_date":"2026-06-16T00:00:00+00:00","remediations":[{"category":"vendor_fix","date":"2026-09-08T09:03:27+00:00","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","product_ids":["AppStream-9.2.0.Z.E4S:virtio-win-0:1.9.58-0.el9_2.noarch","AppStream-9.2.0.Z.E4S:virtio-win-0:1.9.58-0.el9_2.src"],"restart_required":{"category":"none"},"url":"https://access.redhat.com/errata/RHBA-2026:65127"},{"category":"workaround","details":"This flaw requires local access to a Windows guest with the virtio-vsock driver installed. The following steps reduce exposure:\n\n1. Disable the viosock driver on guests that do not need VM socket communication. Stop the viosock service and set its startup type to Disabled. This eliminates the attack surface entirely and is the strongest interim mitigation.\n2. Verify memory protections are active in the guest. These raise the cost of exploiting the heap overflow significantly.\n3. Minimize guest-to-host attack surface on the hypervisor. Even a full guest kernel compromise is contained by the KVM boundary. Disable unnecessary virtio devices and limit PCI passthrough to reduce the risk of chaining with a separate host escape.","product_ids":["AppStream-9.2.0.Z.E4S:virtio-win-0:1.9.58-0.el9_2.noarch","AppStream-9.2.0.Z.E4S:virtio-win-0:1.9.58-0.el9_2.src"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["AppStream-9.2.0.Z.E4S:virtio-win-0:1.9.58-0.el9_2.noarch","AppStream-9.2.0.Z.E4S:virtio-win-0:1.9.58-0.el9_2.src"]}],"threats":[{"category":"impact","details":"Important"}],"title":"virtio-win: viosock.sys: integer overflow in VIOSockSelect leads to heap-based buffer overflow"}]}