CVE-2026-5164: 
Linux Red Hat vulnerability analysis and mitigation

CVE-2026-5164 is a buffer overflow vulnerability in the virtio-win RhelDoUnMap() function (viostor driver) that allows a local user to trigger a system crash (Blue Screen of Death / BSOD) by supplying an excessive number of descriptors in an unmap request. The flaw affects Red Hat's virtio-win package as shipped with Red Hat Enterprise Linux 9.0 and 10.0. It was disclosed on March 30, 2026, with a patch merged into the upstream kvm-guest-drivers-windows repository on February 2, 2026. NVD assigns a CVSS v3.1 base score of 5.5 (Medium), while Red Hat's CNA scoring is 6.7 (Medium) (Red Hat Advisory, GitHub Advisory).

The root cause is CWE-120 (Buffer Copy without Checking Size of Input — Classic Buffer Overflow). The adaptExt->blk_discard array in the viostor driver is statically sized for 16 descriptors, but RhelDoUnMap() never validates the BlockDescrCount value taken from a user-supplied buffer before writing to the array. Because MAX_DISCARD_SEGMENTS was previously defined as 256, the driver could advertise support for far more segments than the array can hold, and a malicious local user can craft an unmap request with an arbitrarily large descriptor count (e.g., 1024) to overflow the buffer. The fix, contributed via GitHub PR #1504, reduces MAX_DISCARD_SEGMENTS to 16, synchronizes the array size with that constant, adds explicit bounds checking on BlockDescrCount, validates the user buffer length before accessing blockDescrDataLength, and moves the blk_discard array to per-request SRB_EXTENSION to eliminate a secondary race condition (Red Hat Bugzilla, GitHub PR #1504).

Successful exploitation causes an immediate system crash (BSOD) on the Windows guest VM running the vulnerable viostor driver, resulting in a complete Denial of Service for that guest. Because the attack is local and targets a kernel-mode driver, there is no direct confidentiality or integrity impact under NVD's assessment (CVSS C:N/I:N/A:H); however, Red Hat's CNA scoring (C:H/I:H/A:H) suggests potential for broader impact depending on privilege escalation context. The scope is limited to the affected guest VM and does not directly impact the hypervisor host or other VMs (Red Hat Advisory, GitHub Advisory).

1. Gain local access: Obtain a local user account on a Windows guest VM running the vulnerable virtio-win viostor driver (shipped with RHEL 9.0 or 10.0 virtio-win packages).
2. Identify the vulnerable driver: Confirm the viostor driver is loaded and the virtio-blk device is present (e.g., via Device Manager or driverquery on Windows).
3. Craft a malicious unmap request: Construct a SCSI UNMAP (or equivalent storage IOCTL) request with an excessively large BlockDescrCount value — the researcher reproduced the crash using 1024 descriptors, far exceeding the 16-element blk_discard array.
4. Submit the request: Issue the crafted unmap request to the virtio-blk device through the Windows storage stack (e.g., via DeviceIoControl with IOCTL_STORAGE_MANAGE_DATA_SET_ATTRIBUTES or a direct SCSI pass-through).
5. Trigger BSOD: The RhelDoUnMap() function writes past the end of the blk_discard array, corrupting kernel memory and causing an immediate system crash (Red Hat Bugzilla, GitHub PR #1504).

• Logs: Windows Event Log entries for a critical system crash (Event ID 1001 — BugCheck) immediately following storage unmap/TRIM operations; crash dump files (.dmp) in %SystemRoot%\Minidump or %SystemRoot%\MEMORY.DMP referencing the viostor driver.
• Process/Driver: Unexpected BSOD with a stop code related to memory corruption (e.g., DRIVER_CORRUPTED_EXPOOL, SYSTEM_SERVICE_EXCEPTION, or MEMORY_MANAGEMENT) with viostor.sys in the call stack.
• File System: Presence of crash dump files generated around the time of suspicious storage activity.
• Network: No network-based IOCs — exploitation is entirely local to the guest VM.

The fix was merged into the upstream virtio-win/kvm-guest-drivers-windows repository on February 2, 2026 (PR #1504). Users should update to a patched version of the virtio-win package provided by Red Hat for RHEL 9 and RHEL 10 once an errata advisory is published. As a workaround, restricting local user privileges to prevent issuance of raw storage IOCTL/SCSI UNMAP commands can reduce exposure. Organizations should monitor the Red Hat Customer Portal for the official errata and apply the updated virtio-win driver to all affected Windows guest VMs (Red Hat Advisory, GitHub PR #1504).