rhba-2026:65128

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for virtio-win is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The virtio-win package provides paravirtualized network drivers for most Microsoft Windows operating systems. Paravirtualized drivers are virtualization-aware drivers used by fully virtualized guests running on Red Hat Enterprise Linux. Fully virtualized guests using the paravirtualized drivers gain significantly better I/O performance than fully virtualized guests running without the drivers. \n\nBug Fix(es) and Enhancement(s):\n\n* [virtio-win][viogpu] Reject resolutions exceeding framebuffer segment capacity [rhel-9.6.z] (JIRA:RHEL-212015)\n\n* Someone driver works with debug level >= 6 (debug message flood) [rhel-9.6.z] (JIRA:RHEL-212407)\n\n* Virtio-win may not configure guest cache mode when using virtio-blk [rhel-9.6.z] (JIRA:RHEL-212414)\n\n* [virtio-win] NetKVM (virtio-win 0.1.285) does not transmit USO packets correctly [rhel-9.6.z] (JIRA:RHEL-212419)\n\n* viosock: Validate fd_count in VIOSockSelect against overflow and empt? [rhel-9.6.z] (JIRA:RHEL-212423)\n\n* [Windows]Can not connect to VM via vsock after migration [rhel-9.6.z] (JIRA:RHEL-212535)\n\n* [virtio-win][viogpu] Provide a way to set a custom screen resolution [rhel-9.6.z] (JIRA:RHEL-212539)\n\n* [viogpudo] VM crashes with BSOD/black screen when setting invalid resolution values [rhel-9.6.z] (JIRA:RHEL-212543)\n\n* netkvm: treat temporary TX queue full as retry, not drop [rhel-9.6.z] (JIRA:RHEL-212566)\n\n* viosock: Fix spec compliance issues in WSP library and socket driver [rhel-9.6.z] (JIRA:RHEL-212596)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2026:65128",
        "url": "https://access.redhat.com/errata/RHBA-2026:65128"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhba-2026_65128.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: virtio-win bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-11-04T12:51:06+00:00",
      "generator": {
        "date": "2026-11-04T12:51:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHBA-2026:65128",
      "initial_release_date": "2026-09-08T10:12:53+00:00",
      "revision_history": [
        {
          "date": "2026-09-08T10:12:53+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-08T10:12:53+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-04T12:51:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
                  "product_id": "AppStream-9.6.0.Z.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_eus:9.6::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "virtio-win-0:1.9.58-0.el9_6.src",
                "product": {
                  "name": "virtio-win-0:1.9.58-0.el9_6.src",
                  "product_id": "virtio-win-0:1.9.58-0.el9_6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/virtio-win@1.9.58-0.el9_6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "virtio-win-0:1.9.58-0.el9_6.noarch",
                "product": {
                  "name": "virtio-win-0:1.9.58-0.el9_6.noarch",
                  "product_id": "virtio-win-0:1.9.58-0.el9_6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/virtio-win@1.9.58-0.el9_6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "virtio-win-0:1.9.58-0.el9_6.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:virtio-win-0:1.9.58-0.el9_6.noarch"
        },
        "product_reference": "virtio-win-0:1.9.58-0.el9_6.noarch",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "virtio-win-0:1.9.58-0.el9_6.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
          "product_id": "AppStream-9.6.0.Z.EUS:virtio-win-0:1.9.58-0.el9_6.src"
        },
        "product_reference": "virtio-win-0:1.9.58-0.el9_6.src",
        "relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-46655",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-06-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2489170"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in virtio-win. A low-integrity process can issue an IOCTL request to viosock.sys!VIOSockSelect with a maliciously crafted request that causes an integer overflow. This allows the process to circumvent bounds checking, resulting in a heap overflow in the NonPagedPool kernel heap. The flaw could be exploited to escalate privileges on Windows systems running this driver.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "virtio-win: viosock.sys: integer overflow in VIOSockSelect leads to heap-based buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.6.0.Z.EUS:virtio-win-0:1.9.58-0.el9_6.noarch",
          "AppStream-9.6.0.Z.EUS:virtio-win-0:1.9.58-0.el9_6.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46655"
        },
        {
          "category": "external",
          "summary": "RHBZ#2489170",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489170"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46655",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46655"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46655",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46655"
        },
        {
          "category": "external",
          "summary": "https://github.com/virtio-win/kvm-guest-drivers-windows/security/advisories/GHSA-qrhp-4mhp-hjwh",
          "url": "https://github.com/virtio-win/kvm-guest-drivers-windows/security/advisories/GHSA-qrhp-4mhp-hjwh"
        }
      ],
      "release_date": "2026-06-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:12:53+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:virtio-win-0:1.9.58-0.el9_6.noarch",
            "AppStream-9.6.0.Z.EUS:virtio-win-0:1.9.58-0.el9_6.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2026:65128"
        },
        {
          "category": "workaround",
          "details": "This flaw requires local access to a Windows guest with the virtio-vsock driver installed. The following steps reduce exposure:\n\n1. Disable the viosock driver on guests that do not need VM socket communication. Stop the viosock service and set its startup type to Disabled. This eliminates the attack surface entirely and is the strongest interim mitigation.\n2. Verify memory protections are active in the guest. These raise the cost of exploiting the heap overflow significantly.\n3. Minimize guest-to-host attack surface on the hypervisor. Even a full guest kernel compromise is contained by the KVM boundary. Disable unnecessary virtio devices and limit PCI passthrough to reduce the risk of chaining with a separate host escape.",
          "product_ids": [
            "AppStream-9.6.0.Z.EUS:virtio-win-0:1.9.58-0.el9_6.noarch",
            "AppStream-9.6.0.Z.EUS:virtio-win-0:1.9.58-0.el9_6.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.6.0.Z.EUS:virtio-win-0:1.9.58-0.el9_6.noarch",
            "AppStream-9.6.0.Z.EUS:virtio-win-0:1.9.58-0.el9_6.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "virtio-win: viosock.sys: integer overflow in VIOSockSelect leads to heap-based buffer overflow"
    }
  ]
}