CVE-2026-45782 Cloud Hypervisor: Use-after-free in virtio-block Async I/O Completion
A guest can trigger a use-after-free in Cloud Hypervisor via duplicate virtio-block descriptors, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45782?
CVE-2026-45782 is a high-severity use after free vulnerability in cloud-hypervisor, published on 9 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. From version 21.0 to before version 51.2, a guest can cause a use-after-free in the cloud-hypervisor process by submitting two virtio-block descriptor chains that reuse the same head_index while asynchronous block I/O is enabled (e.g. io_uring, aio). When the kernel completes the duplicate operation before the original, the completion path frees a bounce buffer that the kernel is still actively reading from or writing to, corrupting the freed memory. This issue has been patched in versions 51.2 and 52.0.
Weakness: CWE-416
Which versions are affected by CVE-2026-45782?
Linux distribution packages (1)
cloud-hypervisor openSUSE:Tumbleweed | All versions | 52.0-1.1 |
How do I fix CVE-2026-45782?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-45782 being exploited?
There is no known exploitation of CVE-2026-45782 in the wild and no public exploit code.
Sources
Also known as GHSA-f47p-p25q-83rh, openSUSE-SU-2026:10907-1.