Executive brief
A security vulnerability has been identified in QEMU, a widely used virtualization software that allows computers to run multiple operating systems simultaneously. A flaw in how the software handles specific network traffic could allow a user inside a virtual machine to crash the host system's virtualization process. This results in a denial of service, potentially disrupting business operations and causing downtime for all services running on that host.
Technical details
A stack-based buffer overflow (CWE-121) exists in the QEMU e1000 network device emulation. The vulnerability is located in the e1000_receive_iov() function and is triggered when the device processes short network frames in loopback mode. While frame padding logic was moved to the network core, the e1000 receive path still accepts unpadded short frames in loopback scenarios, leading to an out-of-bounds write. A local attacker with access to a guest virtual machine can exploit this to cause a heap/stack corruption that crashes the QEMU process on the host. The issue affects QEMU versions 8.1.0 through 10.1.2 and has been addressed in version 10.1.3.
Affected products
- QEMU Project QEMU 8.1.0 to 10.1.2
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat OpenShift Container Platform 4
Timeline
- 2025-10-31: disclosed
- 2025-10-31: advisory