CVE-2026-6426: 
Linux Red Hat 脆弱性の分析と軽減

CVE-2026-6426 is a type mismatch vulnerability in QEMU's vhost inflight migration VMState handling that can lead to out-of-bounds memory access, resulting in a QEMU process crash or memory corruption. The destination buffer size is stored as a uint64_t but is read by the VMS_VBUFFER load path as a signed int32_t, causing an integer type confusion on little-endian hosts. Affected software includes QEMU/qemu-kvm as shipped in Red Hat Enterprise Linux (multiple versions) and Red Hat CoreOS (RHCOS). The vulnerability was reported by Seungjung Kim of Kyonggi University and published on August 10, 2026. It carries a CVSS v3.1 base score of 4.4 (Medium) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-681 (Incorrect Conversion between Numeric Types). The vhost inflight migration VMState stores the destination buffer size as a uint64_t, but the VMS_VBUFFER deserialization path reads it as a signed int32_t. On little-endian hosts, a crafted migration state with bit 31 set causes the value to be interpreted as a negative integer, which is then implicitly converted to a very large size_t. This triggers qemu_get_buffer() to copy migration-stream data far beyond the bounds of the mmap-backed inflight region, constituting a heap out-of-bounds write. Exploitation requires an attacker to control the migration producer or have write access to the migration channel, and the destination QEMU instance must be configured to use vhost inflight migration (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation can cause a crash of the destination QEMU process (denial of service) or memory corruption in the hypervisor. Because the out-of-bounds write occurs in the QEMU process on the migration destination host, memory corruption could potentially affect other guest VMs or hypervisor-level data structures co-located on the same host, though no confidentiality or integrity impact is currently assessed. The primary confirmed impact is availability loss for the affected virtual machine and potentially the host (Red Hat CVE, Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of publication. The EPSS score is 0.0, reflecting a very low current probability of exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by high attack complexity and the requirement for high privileges (control of the migration producer or write access to the migration channel), significantly limiting the practical attack surface.

1. Identify target: Locate a QEMU/KVM deployment on a little-endian host where vhost inflight migration is enabled (i.e., the inflight parameter is present in the vhost-user device configuration) and where live VM migration is in use.
2. Gain migration channel access: Obtain control of the migration producer (e.g., the source QEMU process or migration management interface) or achieve write access to the migration data channel (e.g., via a compromised management plane or network position).
3. Craft malicious migration state: Construct a migration stream payload in which the vhost inflight VMState buffer size field has bit 31 set, causing the uint64_t value to be misread as a negative int32_t on the destination.
4. Trigger deserialization: Initiate or inject the crafted migration stream toward the destination QEMU instance configured with vhost inflight migration.
5. Achieve out-of-bounds write: The destination QEMU's VMS_VBUFFER load path reads the malformed size, converts it to a very large size_t, and qemu_get_buffer() copies attacker-controlled data beyond the mmap-backed inflight region, causing a crash or memory corruption (Red Hat CVE, Red Hat Bugzilla).

• Logs: Unexpected QEMU process crash logs or segmentation fault entries in /var/log/libvirt/qemu/<vm>.log on the migration destination host during or after a live migration event.
• Process: Abnormal termination of the qemu-kvm process on the destination host coinciding with a migration operation involving vhost-user devices with inflight enabled.
• Network: Anomalous or malformed migration stream traffic on the QEMU migration port (default TCP 49152+) with unusually large or malformed buffer size fields in the VMState payload.
• File System: Core dump files generated by the QEMU process (e.g., core.<pid>) in the working directory or configured core dump path, indicating an unexpected crash during migration.

Red Hat has acknowledged the vulnerability and a patch is in progress (tracked in Bugzilla 2513498). As a configuration-based workaround, vhost inflight migration can be disabled by omitting the inflight parameter from the vhost-user device configuration; this prevents the vulnerable VMState deserialization path from being reached on the destination. Environments that require vhost inflight migration for live migration of vhost-user devices cannot use this workaround and should prioritize applying the vendor fix once released. Organizations should also restrict access to the QEMU migration channel to trusted management networks (Red Hat CVE, Red Hat Bugzilla).

Red Hat credited Seungjung Kim of Kyonggi University for responsibly reporting the issue and published the CVE advisory on August 10, 2026 (Red Hat CVE). No significant broader community discussion, social media commentary, or media coverage has been identified at this time, consistent with the vulnerability's moderate severity and constrained exploitation requirements.