CVE-2026-6426

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)

Description A type mismatch exists in the vhost inflight migration VMState handling. The destination buffer size is stored as a uint64 t but is read by the VMS VBUFFER load path as a signed int32 t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and implicitly converted to a very large size t. This leads the qemu get buffer() function to copy migration-stream data beyond the bounds of the mmap-backed inflight region, potentially resulting in memory corruption or a process crash. Exploitation requires control of the migration producer or write access to the migration channel, and a destination configured for vhost inflight migration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.