---
id: CVE-2026-6426
title: >-
  A type mismatch vulnerability was found in QEMU's vhost inflight migration
  VMState handling
summary: >-
  A type mismatch vulnerability was found in QEMU's vhost inflight migration
  VMState handling. The destination buffer size is stored as a uint64_t but read
  by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a
  crafted…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-681
vendor: Red Hat
product: qemu-kvm
affected:
  - qemu-kvm (all versions)
  - qemu-kvm (all versions)
  - qemu-kvm (all versions)
  - qemu-kvm-ma (all versions)
  - 'virt:rhel/qemu-kvm (all versions)'
  - qemu-kvm (all versions)
  - qemu-kvm
  - openshift/ose-rhel-coreos-8 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
published: '2026-08-10'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T11:17:15.507'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6426'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-6426'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2513498'
    label: secalert@redhat.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6426.json
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-6426'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6426'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-11T17:41:11.267441Z'
epss: 0.00394
epssPercentile: 0.3091
ingestedAt: '2026-09-18T11:40:03.677Z'
---

## Overview

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region.

This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux for NVIDIA 26, … · no fix planned: Red Hat Enterprise Linux for NVIDIA 26, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, … · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6426.json)