CVE-2026-6426

Received Received - Intake

Type Mismatch in QEMU Vhost Inflight Migration VMState Handling

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: Red Hat, Inc.

Description

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-6426

Affected Vendors & Products

Vendor	Product	Version / Range
qemu	qemu	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-681	When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Attack-Flow Graph

Executive Summary

This is a type mismatch vulnerability in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read as a signed int32_t. On little-endian hosts, a crafted migration state with bit 31 set causes the value to be interpreted as negative and converted to a very large size_t, leading to out-of-bounds memory copy during migration.

Detection Guidance

Detection requires monitoring for unusual migration behavior or crashes in QEMU processes. Check QEMU logs for migration errors or segmentation faults. Inspect network traffic for unexpected migration data sizes. No specific commands are provided in the context.

Impact Analysis

This vulnerability can cause QEMU process crashes or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination using vhost inflight migration.

Mitigation Strategies

Disable vhost inflight migration in QEMU configurations. Apply patches from QEMU if available. Restrict access to migration channels to trusted sources only. Monitor QEMU processes for crashes or memory corruption.

Hi! I’m here to help you understand CVE-2026-6426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70