Junglewise Threat Intelligence

CVE-2026-45782: Cloud Hypervisor use-after-free in virtio-block async I/O completion

CVE-2026-45782 · Severity: info · CVSS 8.9 · Published 2026-06-10

Executive brief

Cloud Hypervisor is a tool used to run virtual machines in cloud environments. A security flaw has been found where a malicious or malfunctioning guest virtual machine can cause the main hypervisor process to crash or corrupt its memory. This could potentially allow an attacker to escape the virtual machine's boundaries or disrupt services on the host server.

Technical details

A use-after-free vulnerability exists in the virtio-block implementation of Cloud Hypervisor when using asynchronous backends like io_uring or aio. A guest can trigger this by submitting two descriptor chains that reuse the same head_index before the first has been processed. Because the hypervisor tracks in-flight requests using a linear match on the head_index, a faster completion of the second request can cause the hypervisor to prematurely free a bounce buffer still in use by the kernel for the first request. This leads to memory corruption within the cloud-hypervisor process. The issue is patched in versions 51.2 and 52.0.

Affected products

  • Cloud Hypervisor Cloud Hypervisor v21.0 to v51.1

Timeline

  • 2026-05-14: patched: Fixes released in v51.2 and v52.0
  • 2026-05-14: advisory: GitHub Security Advisory GHSA-f47p-p25q-83rh published
  • 2026-06-10: disclosed: CVE-2026-45782 published to NVD

References