CVE-2026-13216

The virtio PCI driver drivers/virtio/virtiopci.c parses a device's PCI capability list during driver initialization. In virtiopcireadcap the device-supplied capability length byte caplen read from PCI config space via pcieconfread was only checked with asserttmp.caplen == capstructsize. That asse...

CVE-2026-13216 Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length

The virtio PCI driver drivers/virtio/virtiopci.c parses a device's PCI capability list during driver initialization. In virtiopcireadcap the device-supplied capability length byte caplen read from PCI config space via pcieconfread was only checked with asserttmp.caplen == capstructsize. That asse...

PT-2026-81374

The virtio PCI driver drivers/virtio/virtio pci.c parses a device's PCI capability list during driver initialization. In virtio pci read cap the device-supplied capability length byte cap len read from PCI config space via pcie conf read was only checked with asserttmp.cap len == cap struct size...

CVE-2026-13216: Out-of-bounds Write

The virtio PCI driver drivers/virtio/virtiopci.c parses a device's PCI capability list during driver initialization. In virtiopcireadcap the device-supplied capability length byte caplen read from PCI config space via pcieconfread was only checked with asserttmp.caplen == capstructsize. That asse...