{"apiVersion":"1.0","identifier":"CVE-2026-72380","description":"In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response req_id before indexing rsp[] pvcalls_front_event_handler() takes req_id directly from the backend-supplied ring response and uses it to index the fixed-size bedata->rsp[] array for a memcpy() and a store, with no range check. A malicious or buggy backend can set req_id past PVCALLS_NR_RSP_PER_RING and drive an out-of-bounds write past the bedata allocation. req_id was also declared int while the wire field rsp->req_id is u32, so a range check on the signed value alone is insufficient: a backend req_id of 0xffffffff becomes -1, passes a >= PVCALLS_NR_RSP_PER_RING test and indexes bedata->rsp[-1]. Declare req_id as u32 so a single bound covers both ends. A backend that sends an out-of-range req_id has violated the wire protocol, so rather than silently dropping the response, log once and stop trusting the backend: set bedata->disabled. The event handler then ignores further responses, and the request paths that wait for a response return -EIO instead of blocking forever. This mirrors the fatal-error handling xen-netback uses (xenvif_fatal_tx_err()). The pvcalls frontend currently trusts its backend, so this is not a classic-Xen security issue, but it matters for hardening PV frontends against malicious backends (confidential and disaggregated deployments).","publishedAt":"2026-08-15T06:22:11","lastModifiedAt":"2026-08-17T06:18:42","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72380","cvssScore":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00289,"riskScore":0.9,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72380","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72380","en":"https://www.redsauce.net/en/cves/CVE-2026-72380","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72380","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72380","de":"https://www.redsauce.net/de/cves/CVE-2026-72380","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72380","el":"https://www.redsauce.net/el/cves/CVE-2026-72380"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72380"}}