CVE-2026-64456

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwrng: virtio: clamp device-reported used.len at copy_data()

random_recv_done() stores the device-reported used.len directly into

vi->data_avail. copy_data() then indexes vi->data[] using

vi->data_idx (advanced by previous copy_data() calls) and issues a

memcpy() without re-validating either value against the posted

buffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32

or 64).

A malicious or buggy virtio-rng backend can set used.len beyond

sizeof(vi->data), steering the memcpy() past the end of the inline

array into adjacent kmalloc-1k slab bytes. hwrng_fillfn() mixes

those bytes into the guest RNG, and guest root can also observe

them directly via /dev/hwrng.

Concrete impact is inside the guest:

- Memory-safety / hardening: any virtio-rng backend that

over-reports used.len causes the driver to read past vi->data

into unrelated slab contents. hwrng_fillfn() is a kernel thread

that runs as

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References