Description
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region.

This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.
Published: 2026-08-10
Score: 4.4 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A type mismatch in QEMU’s vhost inflight migration VMState handling allows a negative 32‑bit size to be interpreted as a very large unsigned size_t, which causes an out‑of‑bounds copy into an mmap‑backed region. This can corrupt memory or crash the QEMU process, potentially compromising the stability of virtual machines.

Affected Systems

RHEL 6, 7, 8, 9, and 10; RHEL for NVIDIA 26; Red Hat OpenShift Container Platform 4 – all affected when vhost inflight migration is enabled.

Risk and Exploitability

The vulnerability scores a CVSS of 4.4 and has no EPSS data, and it is not listed in KEV. An attacker must control the migration producer or write to the migration channel and must have a destination configured for vhost inflight migration. These conditions limit the attack surface, resulting in a moderate overall risk of crash or memory corruption rather than immediate remote code execution.

Generated by OpenCVE AI on August 10, 2026 at 23:17 UTC.

Remediation

Vendor Workaround

If vhost inflight migration is not required, it can be disabled by omitting the inflight parameter from the vhost-user device configuration. This prevents the vulnerable VMState deserialization path from being reached on the destination. Environments that require vhost inflight migration for live migration of vhost-user devices cannot use this mitigation and should prioritize applying the fix.

OpenCVE Recommended Actions

  • Remove vhost inflight migration by omitting the inflight parameter from the vhost‑user device configuration, preventing the vulnerable code path.
  • Limit migration channel access to trusted, authenticated sources and monitor for unexpected writes to the migration stream to reduce the possibility of a crafted payload.
  • Consider upgrading QEMU when an official patch is released.

Generated by OpenCVE AI on August 10, 2026 at 23:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 10 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Description A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.
Title Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
First Time appeared Redhat
Redhat enterprise Linux
Redhat enterprise Linux Nvidia
Redhat openshift
Weaknesses CWE-681
CPEs cpe:/a:redhat:enterprise_linux_nvidia:
cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat enterprise Linux Nvidia
Redhat openshift
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Enterprise Linux Enterprise Linux Nvidia Openshift
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-10T21:22:29.414Z

Reserved: 2026-04-16T11:09:18.538Z

Link: CVE-2026-6426

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Low

Publid Date: 2026-08-10T00:00:00Z

Links: CVE-2026-6426 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T23:30:07Z

Weaknesses
  • CWE-681

    Incorrect Conversion between Numeric Types