Bug 2453015 (CVE-2026-5165) - CVE-2026-5165 virtio-win: virtio-win: Memory corruption via use-after-free in VirtIO BLK device reset
Summary: CVE-2026-5165 virtio-win: virtio-win: Memory corruption via use-after-free in...
Keywords:
Status: NEW
Alias: CVE-2026-5165
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-30 14:47 UTC by OSIDB Bzimport
Modified: 2026-03-30 15:01 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-03-30 14:47:30 UTC
The VirtIO BLK device does not have special reset events/routines
like the VirtIO SCSI device (controlq command VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET),
but Windows requires to have some mechanism to fix a device when it hangs.
The most appropriate way is perform a full VirtIO reset and initialization
flow based on spec.

The following flow is implemented:

Reset VirtIO device (virtio_device_reset)
Delete VirtIO queues (virtio_delete_queues)
Clean up all device memory (virtio_device_shutdown)
Complete all pending SRBs (in guest, CompletePendingRequestsOnReset)
Perform VirtIO device initialization (virtio_device_initialize, virtio_find_queues, etc)
Note: We don't pause StorPort because the port driver pauses all device IO queues for the
adapter and then calls the HwStorResetBus routine
https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/storport/nc-storport-hw_reset_bus

Note: We cannot just complete all pending SRBs and continue, because this
memory will be still in use by the device and free in Windows. As a result,
we got use-after-free when the device completes the request and sends it back to Windows.
This may cause a memory corruption, as Windows may already have reused the memory.


Note You need to log in before you can comment on or make changes to this bug.