CVE-2026-68255

This vulnerability is an information disclosure flaw in the VirtIO GPU driver's EDID parsing. The driver trusts device-supplied size and block count values without validating them against the fixed kernel buffer, allowing a malicious or compromised VirtIO backend to trigger out-of-bounds reads into adjacent kernel memory. The CVSS of 7.7 correctly reflects the potential severity — kernel memory disclosure is never trivial. The EPSS of 0.00209 suggests low probability of exploitation in the wild, and the gap is worth understanding. The threat model is the key. VirtIO backends are typically controlled by the hypervisor, which already has full control over the guest VM. Exploiting this bug from within the guest requires either a compromised backend (possible in nested virtualization or untrusted VM configurations) or a malicious hypervisor — and in the latter case, the hypervisor already has better options than reading scattered EDID buffer contents. This suggests the vulnerability functions more as defense-in-depth for unusual deployment topologies than as a standalone guest kernel hardening issue. For defenders: prioritize patching based on your deployment model. If you control both hypervisor and guest in a standard configuration, the practical risk is low — exploitation would require the attacker to already control the hypervisor. However, if you run nested virtualization, confidential computing with untrusted hosts, or multi-tenant environments where the VirtIO backend may not be fully trusted, treat this as higher priority. The adjacent kernel heap memory could contain secrets, session tokens, or cryptographic material useful for privilege escalation. The broader question: does this fix imply the kernel now formally models VirtIO backends as untrusted, potentially adversarial entities? The VirtIO specification describes a cooperative hypervisor-guest relationship and doesn't flag 'consider that the backend might lie about sizes.' This bug emerged not because a developer missed a bounds check, but because the abstraction boundary between trusted backend and adversarial host wasn't formally modeled. Audit other VirtIO device drivers for analogous patterns — device-supplied sizes and counts validated against fixed kernel structures without proper bounds checking. The historical pattern from USB and PCI subsystems suggests more similar CVEs may surface as this subsystem undergoes systematic review.

Reviewed through automated stages and approved by a human before publication.