Log in Start free

Vulnerability · Published Jun 9, 2026 · Assigned by GitHub_M

CVE-2026-45782Cloud Hypervisor: Use-after-free in virtio-block Async I/O Completion

High 8.9

In plain English

A high-severity use-after-free in cloud-hypervisor from cloud-hypervisor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 4.0)8.9High
Exploit odds (30 days)0.1%top 96.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. From version 21.0 to before version 51.2, a guest can cause a use-after-free in the cloud-hypervisor process by submitting two virtio-block descriptor chains that reuse the same head_index while asynchronous block I/O is enabled (e.g. io_uring, aio). When the kernel completes the duplicate operation before the original, the completion path frees a bounce buffer that the kernel is still actively reading from or writing to, corrupting the freed memory. This issue has been patched in versions 51.2 and 52.0.

Affected products (as reported)

VendorProductVersions
cloud-hypervisor cloud-hypervisor >= 21.0, < 51.2

Weakness: CWE-416 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References