CVE-2026-6426: 
QEMU vulnerability analysis and mitigation

CVE-2026-6426 is a type mismatch vulnerability in QEMU's vhost inflight migration VMState handling that can lead to out-of-bounds memory access, resulting in a QEMU process crash or memory corruption. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t, causing an integer type confusion on little-endian hosts. Affected software includes Red Hat's qemu-kvm packages across multiple RHEL versions and RHCOS. The vulnerability was reported by Seungjung Kim of Kyonggi University and published on August 10, 2026. It carries a CVSS v3.1 base score of 4.4 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-681 (Incorrect Conversion between Numeric Types). The inflight buffer size field in QEMU's vhost inflight migration VMState is stored as a uint64_t, but the VMS_VBUFFER deserialization path reads it as a signed int32_t. On little-endian hosts, a crafted migration stream with bit 31 set in this field causes the value to be interpreted as a large negative integer, which is then implicitly converted to a very large size_t value. This causes qemu_get_buffer() to copy migration-stream data far beyond the bounds of the mmap-backed inflight region, triggering a heap/memory overflow. Exploitation requires the attacker to control the migration producer or have write access to the migration channel, and the destination must be configured to use vhost inflight migration (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation can cause a crash of the destination QEMU process (denial of service) or memory corruption in the hypervisor. Because the out-of-bounds write occurs in the QEMU process on the destination host during live migration, memory corruption could potentially affect other virtual machines or host memory regions co-located on the same hypervisor, though the scope is marked as unchanged. There is no confidentiality or integrity impact assessed in the CVSS scoring; the primary risk is availability loss of the affected VM and potential host instability (Red Hat CVE, GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of publication. The NVD SSVC assessment confirms exploitation is "none" and the attack is not automatable, reflecting the high privilege and complexity requirements. The EPSS score is approximately 0.239% (15th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, GitHub Advisory).

1. Identify target: Locate a QEMU/KVM deployment configured with vhost-user devices that use the inflight parameter, enabling vhost inflight migration on the destination host.
2. Gain migration channel access: Obtain control of the migration producer (e.g., the source QEMU process or the migration management interface) or achieve write access to the live migration data channel (e.g., via a compromised management plane or network interception).
3. Craft malicious migration stream: Construct a VMState migration stream in which the vhost inflight buffer size field has bit 31 set (e.g., a value ≥ 0x80000000), so that when read as a signed int32_t it appears negative.
4. Trigger deserialization: Initiate or inject the crafted migration stream to the destination QEMU process, causing the VMS_VBUFFER load path to interpret the size as a very large size_t.
5. Achieve out-of-bounds write: qemu_get_buffer() copies migration data beyond the mmap-backed inflight region, resulting in a QEMU process crash (DoS) or memory corruption on the destination host (Red Hat CVE, Red Hat Bugzilla).

• Process: Unexpected crash or segmentation fault of the qemu-kvm process on the destination hypervisor during or immediately after a live migration event.
• Logs: Kernel or QEMU logs showing segfault, SIGABRT, or memory corruption errors originating from qemu_get_buffer() or vhost inflight VMState deserialization during migration; entries in /var/log/libvirt/qemu/<vm>.log indicating abnormal termination.
• Network: Anomalous or malformed data on the QEMU live migration TCP stream (default port 49152 or configured migration URI) with unusually large buffer size fields in the VMState payload.
• File System: Core dump files generated by the QEMU process in the working directory or /var/crash/ following an unexpected crash during migration.

Red Hat recommends disabling vhost inflight migration if it is not required by omitting the inflight parameter from the vhost-user device configuration; this prevents the vulnerable VMState deserialization path from being reached on the destination. Environments that require vhost inflight migration for live migration of vhost-user devices cannot use this workaround and should prioritize applying the vendor-supplied fix once available. Patches are tracked under Red Hat Bugzilla 2513498, and affected products include qemu-kvm across RHEL 6–10, qemu-kvm-ma, virt:rhel/qemu-kvm, virt-devel:rhel/qemu-kvm, and rhcos (Red Hat CVE, Red Hat Bugzilla).

Red Hat credited Seungjung Kim of Kyonggi University for responsibly reporting this issue. The vulnerability was assessed as low severity/priority in Red Hat's Bugzilla triage. No significant broader community discussion, vendor statements beyond Red Hat, or notable media coverage has been identified at this time (Red Hat CVE, Red Hat Bugzilla).