CVE-2026-45782: Cloud Hypervisor: Use-after-free in virtio-block Async I/O Completion
Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. From version 21.0 to before version 51.2, a guest can cause a use-after-free in the cloud-hypervisor process by submitting two virtio-block descriptor chains that reuse the same headindex while asynchronous block I/O is enabled (e.g. iouring, aio). When the kernel completes the duplicate operation before the original, the completion path frees a bounce buffer that the kernel is still actively reading from or writing to, corrupting the freed memory. This issue has been patched in versions 51.2 and 52.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cloud-hypervisorto a version that resolves this vulnerability.Fixed in 51.2 - Upgrade
Upgrade
cloud-hypervisorto a version that resolves this vulnerability.Fixed in 52.0 - Configuration
Disable asynchronous block I/O (for example io_uring or aio) for guest virtio-block devices until Cloud Hypervisor is upgraded to a fixed version.
virtio-block (Cloud Hypervisor) asynchronous block I/O = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45782?
CVE-2026-45782 has a high severity rating of 8.9.
What type of vulnerability is CVE-2026-45782?
CVE-2026-45782 is a use-after-free vulnerability affecting the Cloud Hypervisor.
How do I fix CVE-2026-45782?
To fix CVE-2026-45782, upgrade to Cloud Hypervisor version 51.2 or later.
What could happen if CVE-2026-45782 is exploited?
If exploited, CVE-2026-45782 could lead to remote code execution in the cloud-hypervisor process.
Which software versions are affected by CVE-2026-45782?
CVE-2026-45782 affects Cloud Hypervisor versions from 21.0 to before 51.2.