CVE-2026-120831: Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
A flaw was found in libslirp in ifoutput() in src/if.c. When demoting an interactive session from the fast queue to the batch queue after throughput limits were exceeded, the code called slirpremque() and slirpinsque() on ifm->mnextpkt (an arbitrary packet in the circular session list) instead of the session queue head. This corrupted doubly-linked queue pointers. Subsequent traversals in ifstart() could crash the host process that embeds libslirp (for example QEMU or slirp4netns), resulting in a guest-to-host denial of service.
Other sources
A flaw was found in libslirp in ifoutput(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.
— NVD