diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c
index b3aee7259..18c17b398 100644
--- a/lib/vhost/vhost.c
+++ b/lib/vhost/vhost.c
@@ -888,6 +888,7 @@ static int
 vhost_parse_core_mask(const char *mask, struct spdk_cpuset *cpumask)
 {
 	int rc;
+	struct spdk_cpuset negative_vhost_mask;
 
 	if (cpumask == NULL) {
 		return -1;
@@ -904,6 +905,16 @@ vhost_parse_core_mask(const char *mask, struct spdk_cpuset *cpumask)
 		return -1;
 	}
 
+	spdk_cpuset_copy(&negative_vhost_mask, &g_vhost_core_mask);
+	spdk_cpuset_negate(&negative_vhost_mask);
+	spdk_cpuset_and(&negative_vhost_mask, cpumask);
+
+	if (spdk_cpuset_count(&negative_vhost_mask) != 0) {
+		SPDK_ERRLOG("one of selected cpu is outside of core mask(=%s)\n",
+			    spdk_cpuset_fmt(&g_vhost_core_mask));
+		return -1;
+	}
+
 	spdk_cpuset_and(cpumask, &g_vhost_core_mask);
 
 	if (spdk_cpuset_count(cpumask) == 0) {
diff --git a/test/unit/lib/vhost/vhost.c/vhost_ut.c b/test/unit/lib/vhost/vhost.c/vhost_ut.c
index 3ff5cc619..df1c32d28 100644
--- a/test/unit/lib/vhost/vhost.c/vhost_ut.c
+++ b/test/unit/lib/vhost/vhost.c/vhost_ut.c
@@ -297,6 +297,10 @@ create_controller_test(void)
 	ret = alloc_vdev(&vdev, "vdev_name_0", "0xf0");
 	SPDK_CU_ASSERT_FATAL(ret != 0);
 
+	/* Create device with incorrect cpumask partially outside of application cpumask */
+	ret = alloc_vdev(&vdev, "vdev_name_0", "0xff");
+	SPDK_CU_ASSERT_FATAL(ret != 0);
+
 	/* Create device with no name */
 	ret = alloc_vdev(&vdev, NULL, NULL);
 	CU_ASSERT(ret != 0);
diff --git a/test/vhost/other/negative.sh b/test/vhost/other/negative.sh
index fe9150e8d..80eb7dfdc 100755
--- a/test/vhost/other/negative.sh
+++ b/test/vhost/other/negative.sh
@@ -93,6 +93,11 @@ if $rpc_py vhost_create_scsi_controller vhost.invalid.cpumask --cpumask 0xf0; th
 	error "Creating scsi controller with incorrect cpumask succeeded, but it shouldn't"
 fi
 
+notice "Trying to create scsi controller with incorrect cpumask partially outside of application cpumask"
+if $rpc_py vhost_create_scsi_controller vhost.invalid.cpumask --cpumask 0xff; then
+	error "Creating scsi controller with incorrect cpumask succeeded, but it shouldn't"
+fi
+
 notice "Trying to remove device from nonexistent scsi controller"
 if $rpc_py vhost_scsi_controller_remove_target vhost.nonexistent.name 0; then
 	error "Removing device from nonexistent scsi controller succeeded, but it shouldn't"
@@ -172,6 +177,11 @@ if $rpc_py vhost_create_blk_controller vhost.invalid.cpumask Malloc0 --cpumask 0
 	error "Creating block controller with incorrect cpumask succeeded, but it shouldn't"
 fi
 
+notice "Trying to create block controller with incorrect cpumask partially outside of application cpumask"
+if $rpc_py vhost_create_blk_controller vhost.invalid.cpumask Malloc0 --cpumask 0xff; then
+	error "Creating block controller with incorrect cpumask succeeded, but it shouldn't"
+fi
+
 notice "Trying to remove nonexistent block controller"
 if $rpc_py vhost_delete_controller vhost.nonexistent.name; then
 	error "Removing nonexistent block controller succeeded, but it shouldn't"