A pointer corruption flaw in libslirp’s if_output() function can be triggered when a session moves from the fast queue to the batch queue. An attacker generating burst traffic within a guest can cause libslirp to unlink and reinsert an arbitrary packet through ifm->m_nextpkt, corrupting queue pointers and crashing the host networking process. The flaw is a classic out‑of‑bounds or use‑after‑free error, reflected in CWE-787.

The vulnerability affects Red Hat Enterprise Linux 8, 9, and 10 and Red Hat OpenShift Container Platform 4 and 5. No specific version ranges are listed in the vendor advisory, so all instances of libslirp in these products are potentially impacted until the fix is applied.

The CVSS v3 score of 6.5 indicates medium severity. EPSS data is not available and the issue is not listed in CISA’s KEV catalog, so the current exploitation probability cannot be quantified. The likely attack vector requires a guest or container environment to send high‑volume network traffic to the host, a scenario common in virtualized infrastructures. If exploited, the host’s network stack would crash, leading to a denial of service for all connected clients.