qemu: A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling
CVE-2026-6426 is fixed in qemu on 1 platform by DEBIAN-CVE-2026-6426 (version 1:11.1.2+ds-2), released August 10, 2026. It is not reported as exploited. Patch Radar priority: Routine.
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| qemu · Debian 14 | 1:11.1.2+ds-2 | DEBIAN-CVE-2026-6426 | Aug 10, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.