CVE-2026-120831 in Red Hat
Summary
by MITRE • 11/03/2026
A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in libslirp within the if_output function represents a critical memory corruption flaw that stems from improper handling of packet queues during network session management. Specifically, when the system attempts to transition a network session from a high-priority fast queue to a lower-priority batch queue for processing, the underlying code logic fails to correctly maintain pointer integrity. Instead of properly unlinking and reinserting packets relative to the designated session queue head, the implementation erroneously manipulates pointers via ifm->m_nextpkt against an arbitrary packet location. This deviation from expected memory management practices results in the corruption of internal queue structures, which are fundamental to the stability of the networking stack within the virtualization environment.
From a technical perspective, this flaw is classified as a heap-based buffer overflow or use-after-free variant depending on the specific state of the corrupted pointers, falling under CWE-120 Buffer Copy without Checking Size of Input and CWE-825 Expired Pointer Dereference. The corruption occurs because the code assumes that certain pointer relationships remain valid during queue reorganization, but in practice, accessing an arbitrary packet's next pointer leads to writing invalid addresses into the queue metadata. This structural damage compromises the integrity of the linked list structures used by libslirp to manage network traffic flow, creating a state where subsequent operations on these queues will access memory locations that are either unmapped or contain unrelated data.
The operational impact of this vulnerability is severe for virtualized environments relying on QEMU and libslirp for user-mode networking. An attacker with the ability to generate burst traffic from within a guest operating system can trigger the specific code path responsible for moving sessions between queues. By carefully crafting network packets or sustaining high-volume bursts, the guest can force the host-side networking process into an unstable state characterized by corrupted pointers. This ultimately leads to a segmentation fault or similar critical failure in the host's QEMU process, resulting in a complete denial of service. The virtual machine may become unresponsive as the underlying network infrastructure collapses, disrupting all connectivity for that instance and potentially affecting other workloads if the host system becomes unstable due to resource exhaustion during the crash recovery phase.
This vulnerability aligns with ATT&CK technique T1499 Endpoint Denial of Service, specifically under sub-techniques involving service stop or disruption via memory corruption. The attack vector is remote but requires initial access to a guest VM that shares the host's networking stack through libslirp. Mitigation strategies primarily involve updating libslirp and QEMU to versions where this pointer manipulation logic has been corrected to ensure packets are always linked relative to the correct session queue head rather than arbitrary memory locations. Additionally, administrators should enforce strict network rate limiting within guest configurations to prevent burst traffic from overwhelming the host's processing capabilities during normal operation, thereby reducing the likelihood of triggering edge cases in queue management code until patches can be applied.