CVE catalog
CVE-2026-5165
A flaw was found in virtio-win, specifically within the VirtIO Block (BLK) device. When the device undergoes a reset, it fails to properly manage memory, resulting in a use-after-free vulnerability. T
- Severity
- Medium · CVSS 6.7
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.11% · Oct 25, 2026
A flaw was found in virtio-win, specifically within the VirtIO Block (BLK) device. When the device undergoes a reset, it fails to properly manage memory, resulting in a use-after-free vulnerability. This issue could allow a local attacker to corrupt system memory, potentially leading to system instability or unexpected behavior. virtio-win: virtio-win: Memory corruption via use-after-free in VirtIO BLK device reset A moderate vulnerability use-after-free flaw in the VirtIO Block (BLK) device within virtio-win can lead to memory corruption during device reset. A local attacker within the guest operating system could exploit this to cause system instability or unexpected behavior. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | virtio-win | Not reported | Not reported | unknown |
| Cpe | enterprise_linux | Not reported | Not reported | unknown |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: