CVE-2026-5165

Published: Mar 30, 2026Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A flaw was found in virtio-win, specifically within the VirtIO Block (BLK) device. When the device undergoes a reset, it fails to properly manage memory, resulting in a use-after-free vulnerability. This issue could allow a local attacker to corrupt system memory, potentially leading to system instability or unexpected behavior.

Affected (3)

Products: Redhat: Enterprise Linux, Virtio Win

2 products

Enterprise Linux

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 10.0
Redhat Enterprise Linux	Version 9.0
Redhat Virtio Win	All versions

Related CWEs

Expired Pointer Dereference

The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

References (3)

https://access.redhat.com/security/cve/CVE-2026-5165

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2453015

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://github.com/virtio-win/kvm-guest-drivers-windows/pull/1493

Source: secalert@redhat.com

Issue Tracking

Timeline

No history available yet.