CVE-2025-14876
Uncontrolled Memory Allocation in QEMU virtio-crypto Causes DoS
Publication date: 2026-02-18
Last updated on: 2026-02-18
Assigner: Fedora Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qemu | qemu | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-14876 is a vulnerability in the virtio-crypto device of QEMU-KVM. The issue occurs because the AKCIPHER path within virtio-crypto does not enforce any length limit on memory allocation, unlike the symmetric path which uses a maximum size limit.
This missing length limit allows a malicious guest operating system to trigger unbounded memory allocation on the host system.
As a result, this can lead to memory exhaustion and cause the QEMU process on the host to terminate unexpectedly.
How can this vulnerability impact me? :
This vulnerability can cause a denial of service (DoS) on the host system running QEMU-KVM.
A malicious guest operating system can exploit the missing length limit to allocate excessive memory, leading to memory exhaustion.
The exhaustion of memory resources can cause the QEMU process to abort, disrupting services and potentially affecting availability of virtualized environments.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves uncontrolled memory allocation in the virtio-crypto device of QEMU, which can cause the QEMU process to terminate unexpectedly due to memory exhaustion.
Detection can focus on monitoring the QEMU process for abnormal termination or crashes, and observing unusual memory usage patterns on the host system running QEMU-KVM.
Specific commands to help detect this issue include:
- Use system logs to check for QEMU process crashes: `journalctl -u libvirtd` or `journalctl -xe`
- Monitor QEMU process memory usage with: `ps aux | grep qemu` or `top`/`htop` focusing on QEMU processes
- Check for OOM (Out Of Memory) killer activity in system logs: `dmesg | grep -i oom`
- If possible, enable debugging or verbose logging for QEMU to capture any errors related to virtio-crypto device operations.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to apply the patch that addresses the missing length limit in the AKCIPHER path of the virtio-crypto device in QEMU.
This patch has been developed and is available upstream in the QEMU project repository.
Until the patch can be applied, consider limiting or disabling the use of the virtio-crypto device in guest virtual machines to prevent exploitation.
Additionally, monitor the host system for signs of memory exhaustion or QEMU process crashes and restart affected services as needed.