CVE-2026-48914: Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-12 · updated 2026-08-31
Weakness: CWE-122

Description

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.

Affected products

Red Hat OpenShift Container Platform 4.18: all versions
Red Hat Enterprise Linux 10: all versions — fixed in 18:10.1.0-16.el10_2.5
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions — fixed in 17:10.1.0-17.el9_8.4
Red Hat Enterprise Linux for NVIDIA 26: all versions

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 18:10.1.0-16.el10_2.5; Red Hat Enterprise Linux 9 17:10.1.0-17.el9_8.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-48914 or the next vulnerability affects your stack