---
id: CVE-2026-43248
title: 'vhost: move vdpa group bound check to vhost_vdpa'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vhost: move vdpa group bound check to vhost_vdpa

  Remove duplication by consolidating these here.  This reduces the
  posibility of a parent driver missing them.

  While w…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bda324fd037a6b0d44da5699574ce741ca161bc4 <
    ddb57354634b6ba851b79da45f1de42c646f27d0
  - >-
    Linux >= bda324fd037a6b0d44da5699574ce741ca161bc4 <
    7441d35d14d9a3d66d925d90cb73c75394e6d454
  - >-
    Linux >= bda324fd037a6b0d44da5699574ce741ca161bc4 <
    406db68f9cb976a8ddfafd631197264f2307e9c9
  - >-
    Linux >= bda324fd037a6b0d44da5699574ce741ca161bc4 <
    cd025c1e876b4e262e71398236a1550486a73ede
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:16:04.394477Z'
published: '2026-05-06'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:37.752Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43248'
references:
  - url: 'https://git.kernel.org/stable/c/ddb57354634b6ba851b79da45f1de42c646f27d0'
  - url: 'https://git.kernel.org/stable/c/7441d35d14d9a3d66d925d90cb73c75394e6d454'
  - url: 'https://git.kernel.org/stable/c/406db68f9cb976a8ddfafd631197264f2307e9c9'
  - url: 'https://git.kernel.org/stable/c/cd025c1e876b4e262e71398236a1550486a73ede'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02227
ingestedAt: '2026-10-16T17:24:46.689Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vhost: move vdpa group bound check to vhost_vdpa

Remove duplication by consolidating these here.  This reduces the
posibility of a parent driver missing them.

While we're at it, fix a bug in vdpa_sim where a valid ASID can be
assigned to a group equal to ngroups, causing an out of bound write.

## Affected

- `Linux >= bda324fd037a6b0d44da5699574ce741ca161bc4 < ddb57354634b6ba851b79da45f1de42c646f27d0`
- `Linux >= bda324fd037a6b0d44da5699574ce741ca161bc4 < 7441d35d14d9a3d66d925d90cb73c75394e6d454`
- `Linux >= bda324fd037a6b0d44da5699574ce741ca161bc4 < 406db68f9cb976a8ddfafd631197264f2307e9c9`
- `Linux >= bda324fd037a6b0d44da5699574ce741ca161bc4 < cd025c1e876b4e262e71398236a1550486a73ede`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.