#vdpa

vhost IOTLB path leaks kernel memory via unchecked user access

A CAP_NET_ADMIN controller can aim vdpa_sim virtqueues at kernel addresses and read two bytes per kick after a missing access_ok check.