CVE-2026-6426: Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64t but read by the VMSVBUFFER load path as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large sizet, leading qemugetbuffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region.
This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.
Other sources
QEMU's vhost inflight migration VMState handling uses a uint64t field for the destination buffer size, while the VMSVBUFFER load path reads the field as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set can cause the negative value to be converted to a very large sizet. QEMU may then copy migration-stream data beyond the mmap-backed destination inflight region, causing a destination QEMU process crash or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel and a configuration using vhost inflight migration.
Acknowledgments: Seungjung Kim (Kyonggi University)
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6426?
The severity of CVE-2026-6426 is medium with a score of 4.4.
How do I fix CVE-2026-6426?
To mitigate CVE-2026-6426, upgrade to the latest version of QEMU that addresses this vulnerability.
What vulnerabilities are associated with CVE-2026-6426?
CVE-2026-6426 is associated with a type mismatch in the handling of vhost inflight migration VMState, leading to out-of-bounds access.
What is the impact of CVE-2026-6426?
CVE-2026-6426 may allow unauthorized access to memory which could compromise system integrity or availability.
Which software versions are affected by CVE-2026-6426?
CVE-2026-6426 affects QEMU versions that implement vhost inflight migration VMState handling.