Vulnerability · Published Mar 30, 2026 · Assigned by redhat

CVE-2026-5164Virtio-win: virtio-win: denial of service via unvalidated descriptor count in unmap request

Medium 6.7

In plain English

A medium-severity buffer overflow in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)0.1%top 98.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in virtio-win. The `RhelDoUnMap()` function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 9	see references

Weakness: CWE-120 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-5164 vdb-entry, x_refsource_REDHAT
RHBZ#2453014 issue-tracking, x_refsource_REDHAT
https://github.com/virtio-win/kvm-guest-drivers-windows/pull/1504