Out-of-bounds write in Kata Containers - #VU139372
Published: July 26, 2026
Vulnerability identifier: #VU139372
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary code on the host.
The vulnerability exists due to out-of-bounds read and out-of-bounds write in the Dragonball virtio-blk device emulation when processing guest-supplied virtio-blk descriptors. A local user can submit a crafted virtio-blk request with an address near the end of guest RAM and an oversized length to execute arbitrary code on the host.
Exploitation requires the ability to write raw descriptors into the virtio-blk virtqueue from the guest kernel context, and some Kata guest kernels expose this to guest userspace root.
Affected software
Kata Containers
Remediation
Install security update from vendor's website.
Kata Containers - update to 4.0.0