drivers/vhost/net.c in the Linux kernel before 3.13.10 when mergeable buffers are disabled does not properly validate packet lengths which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets related to the handle_rx and get_rx_bufs functions.