{"id":"CVE-2026-13212","summary":"Zephyr virtio driver calls an arbitrary function pointer from an out-of-range used-ring descriptor id","details":"The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virtio_common.c), the device-written vq-\u003eused-\u003ering[idx].id is used directly as an index into vq-\u003erecv_cbs[] and vq-\u003edesc[], which are both allocated with exactly vq-\u003enum entries. recv_cbs[] holds {cb, opaque} callback entries, and the indexed callback pointer is then invoked as cbe.cb(cbe.opaque, used_len).\n\nBecause the id is consumed as a 16-bit value with no bound check, a malicious or compromised virtio backend (an untrusted hypervisor, or an untrusted hardware/peer-processor virtio device on a PCI or MMIO transport) can supply an id far beyond vq-\u003enum. This causes an out-of-bounds read of a {function pointer, argument} pair from heap memory beyond recv_cbs[], after which the driver calls that attacker-shaped pointer in the guest's interrupt context. No guest privileges or user interaction are required; the backend triggers it by writing the shared used ring and raising the queue interrupt.\n\nThe result is an arbitrary / attacker-influenced function-pointer call in the Zephyr guest, i.e. a control-flow-hijack primitive that can lead to code execution or, at minimum, a reliable crash. The fix rejects any used-ring id \u003e= vq-\u003enum before indexing recv_cbs[]/desc[] or invoking the callback. This affects builds using CONFIG_VIRTIO with the PCI or MMIO transport.","aliases":["GHSA-7884-373w-qqhx"],"modified":"2026-08-28T14:33:01.604375Z","published":"2026-08-24T15:43:37.762Z","database_specific":{"cwe_ids":["CWE-129"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13212.json","cna_assigner":"zephyr"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13212.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7884-373w-qqhx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13212"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/fe47dbca080957c425383cc1d5bdc7d48a41d4a5"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"413b789deb391d3a37d06b463288a5fe765ee57e"},{"fixed":"fe47dbca080957c425383cc1d5bdc7d48a41d4a5"}],"database_specific":{"extracted_events":[{"introduced":"4.2.0"},{"fixed":"4.4.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v4.4.0","v4.4.0-rc3","v4.4.0-rc2","v4.4.0-rc1","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13212.json","vanir_signatures_modified":"2026-08-28T14:33:01Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"247618580050569297850761724343547247445","length":991},"id":"CVE-2026-13212-b4f048f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/fe47dbca080957c425383cc1d5bdc7d48a41d4a5","target":{"file":"drivers/virtio/virtio_common.c","function":"virtio_isr"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/fe47dbca080957c425383cc1d5bdc7d48a41d4a5","target":{"file":"drivers/virtio/virtio_common.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["282832166768715638979834972212120771130","220717408574754165600167664114975143109","179482412892757721379271047904099491242"]},"id":"CVE-2026-13212-fedf52c3"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}