CVE-2026-48914: Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling
A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.
Other sources
Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling
— Microsoft
QEMU's virtio-blk device can write past the end of a heap-allocated MMIO bounce buffer while handling a crafted VIRTIOBLKTSCSICMD request. A malicious guest that can program virtio-blk request descriptors can make the second-to-last writable input descriptor point to an MMIO guest physical address with a length of only 1 byte. QEMU maps that descriptor through an exact-size heap bounce buffer, then virtioblkhandlescsi() writes the 4-byte virtioscsiinhdr.errors field without first checking that the descriptor is large enough. A malicious guest can cause an out-of-bounds host heap write in the QEMU process by submitting a malformed virtio-blk SCSI request.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.1.0-8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48914?
The severity of CVE-2026-48914 is medium with a score of 6.7.
What is CVE-2026-48914?
CVE-2026-48914 is a heap buffer overflow vulnerability in QEMU's virtio-blk device due to improper validation of input descriptor sizes.
How do I fix CVE-2026-48914?
To fix CVE-2026-48914, it is recommended to update to the latest version of QEMU that addresses this vulnerability.
Who is affected by CVE-2026-48914?
CVE-2026-48914 affects users of QEMU who utilize the virtio-blk device and have high privilege guests.
What could happen if CVE-2026-48914 is exploited?
If exploited, CVE-2026-48914 could allow a malicious guest to lead to a denial of service or potentially execute arbitrary code on the host.