Vulnerability · Published Aug 10, 2026 · Assigned by redhat
CVE-2026-6426Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
Medium 4.4
In plain English
A medium-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | qemu | no fix listed | DEBIAN-CVE-2026-6426 |
| Debian:13 | qemu | no fix listed | DEBIAN-CVE-2026-6426 |
| Debian:14 | qemu | 1:11.1.2+ds-2 | DEBIAN-CVE-2026-6426 |
| Ubuntu:22.04:LTS | qemu | no fix listed | UBUNTU-CVE-2026-6426 |
| Ubuntu:24.04:LTS | qemu | no fix listed | UBUNTU-CVE-2026-6426 |
| Ubuntu:26.04:LTS | qemu | no fix listed | UBUNTU-CVE-2026-6426 |
| Ubuntu:26.10 | qemu | no fix listed | UBUNTU-CVE-2026-6426 |
| Ubuntu:26.04:LTS | qemu-hwe | no fix listed | UBUNTU-CVE-2026-6426 |
| Ubuntu:26.10 | qemu-hwe | no fix listed | UBUNTU-CVE-2026-6426 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux for NVIDIA 26 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
Weakness: CWE-681 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
References
- https://access.redhat.com/security/cve/CVE-2026-6426 vdb-entry, x_refsource_REDHAT
- RHBZ#2513498 issue-tracking, x_refsource_REDHAT