Skip to content
Fencer Vulns
medium 4.4

CVE-2026-6426 json

Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access

published 2026-08-10 2 mo ago modified 2026-11-06 2 d ago also EUVD-2026-55840

cvss
4.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region.

This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.

Patch / fix

  • qemu Debian 14 1:11.1.2+ds-2

debian advisories DEBIAN-CVE-2026-6426

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-6426 updated cvss 4.4

qemu-kvm: vhost inflight migration VMState integer type mismatch causes out-of-bounds access

  • Red Hat Enterprise Linux 6 qemu-img, qemu-kvm, qemu-kvm-tools, qemu-guest-agent, qemu-guest-agent-win32 Red Hat Enterprise Linux 7 qemu-img, qemu-kvm, libcacard, qemu-img-ma, qemu-kvm-ma, qemu-kvm-tools, +5 more Red Hat Enterprise Linux 8 qemu-img, qemu-kvm, qemu-kvm-core, qemu-kvm-tests, qemu-kvm-common, qemu-guest-agent, +8 more Red Hat Enterprise Linux 9 qemu-img, qemu-kvm, qemu-kvm-core, qemu-kvm-tools, qemu-pr-helper, qemu-kvm-common, +16 more Red Hat Enterprise Linux 10 qemu-kvm
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux for NVIDIA 26 qemu-kvm
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux for NVIDIA 26
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness
  • CWE-681 Incorrect Conversion between Numeric Types

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.