CVE-2026-6426
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In QEMU, a type mismatch vulnerability exists in vhost inflight migration VMState handling. The destination buffer size is stored as uint64_t but read as int32_t, which on little-endian hosts can lead to out-of-bounds reads and crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel.
Risk Assessment
Potential for virtual machine crashes or memory corruption, which could lead to service disruptions and potential data integrity compromise.
Recommendation
Upgrade QEMU to a patched version. Restrict access to the migration channel and ensure only trusted sources can initiate migration.
Original NVD description (English source)
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.