CVE-2026-6426

Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access

Published Aug 10, 2026 CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Description
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region.

This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.

Remediation

Vendor Workaround

If vhost inflight migration is not required, it can be disabled by omitting the inflight parameter from the vhost-user device configuration. This prevents the vulnerable VMState deserialization path from being reached on the destination. Environments that require vhost inflight migration for live migration of vhost-user devices cannot use this mitigation and should prioritize applying the fix.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
cpe:/a:redhat:enterprise_linux:10
cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:openshift:5
cpe:/o:redhat:rhel_els:6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Qemu
Qemu qemu
Redhat enterprise Linux For Nvidia 26
Redhat openshift Container Platform
Vendors & Products Qemu
Qemu qemu
Redhat enterprise Linux For Nvidia 26
Redhat openshift Container Platform
Type Values Removed Values Added
Description A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.
Title Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
First Time appeared Redhat
Redhat enterprise Linux
Redhat enterprise Linux Nvidia
Redhat openshift
Weaknesses CWE-681
CPEs cpe:/a:redhat:enterprise_linux_nvidia:
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat enterprise Linux Nvidia
Redhat openshift
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 6, 2026, 7:10 PM
Reserved
Apr 16, 2026, 11:09 AM
Status
Awaiting Analysis
Published
Aug 10, 2026, 10:17 PM
Modified
Nov 6, 2026, 7:17 PM
Severity
Low
Public date
Aug 10, 2026, 12:00 AM