CVE-2026-3196: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-3196 is an integer overflow vulnerability in the QEMU virtio-snd (virtual sound) device that can be triggered via PCM_INFO requests from a guest virtual machine. A malicious guest with low-level privileges can supply out-of-bounds stream counts, causing unbounded memory allocation on the host and resulting in a denial of service (DoS) condition. The vulnerability affects QEMU versions 8.2.0 through 10.2.1 and was publicly disclosed on June 19, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is an integer overflow or wraparound (CWE-190) in the virtio-snd device's handling of PCM_INFO requests. When a guest provides a crafted, out-of-bounds stream count value, the host-side QEMU process performs an arithmetic calculation that overflows, leading to an excessively large memory allocation request. The attack vector is local (the attacker must control a guest VM on the host), requires only low privileges within the guest, and no user interaction is needed. An upstream patch series was submitted to the QEMU developer mailing list and a fix commit is available at the QEMU GitLab repository (Red Hat Bugzilla).

Successful exploitation results in unbounded memory allocation on the QEMU host process, which can exhaust host memory resources and crash the virtio-snd device service, causing a denial of service condition. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. In multi-tenant virtualization environments, a malicious guest could potentially disrupt other VMs sharing the same host by exhausting host memory (Github Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of disclosure. The NVD SSVC assessment classifies exploitation as "none" and the attack is not automatable. The EPSS score is approximately 0.102%, placing it in the 1st percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

Apply the upstream QEMU fix commit (61679d7dcfa2dffc8fb115aa19b09e0e7cf5ea5c) or update to a patched QEMU release. Vendor-specific patches have been issued by Ubuntu (USN-8161-1), SUSE (SUSE-SU-202621883-1, SUSE-SU-20262386-1), and openSUSE. As a workaround, restrict or disable the virtio-snd device for untrusted guest VMs where audio functionality is not required. Monitor host memory usage for unusual allocation patterns during guest audio operations as an additional precaution (Red Hat Bugzilla, Github Advisory).

The vulnerability was reported via Red Hat's OSIDB system and tracked in Red Hat Bugzilla. Multiple Linux distributions including Ubuntu, SUSE, and openSUSE have issued security advisories and patches. Coverage has been limited to standard vulnerability tracking outlets and distribution security mailing lists, with no notable researcher commentary or significant social media discussion observed.