CVE-2026-6426 Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
An integer type mismatch in QEMU's vhost inflight migration allows out-of-bounds writes, potentially causing crashes or code execution during VM migration.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6426?
CVE-2026-6426 is a medium-severity vulnerability in Red Hat Enterprise Linux 10, published on 10 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region.
This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.
Weakness: CWE-681
Which versions are affected by CVE-2026-6426?
How do I fix CVE-2026-6426?
Apply the vendor's patch.
Is CVE-2026-6426 being exploited?
There is no known exploitation of CVE-2026-6426 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-6426, ECHO-dd45-764e-65f0, GHSA-f3xx-69mr-6rx6, UBUNTU-CVE-2026-6426.