QEMU: guest-triggered out-of-bounds write when a physical memory map returns short

Impact

A local attacker inside a guest can cause QEMU to write past an allocation when cpu_physical_memory_map() returns a shorter length than the caller expected. The write lands in the QEMU process heap on the host, so the consequences range from guest memory disclosure and heap corruption to killing the VM. On a GPU cloud that rents whole VMs with passed-through accelerators, the QEMU process is the tenant boundary, and corrupting it is the first step of a guest-to-host escape. Red Hat rates it 7.8 local with high confidentiality, integrity and availability impact; the record does not claim a working escape.

Who can reach it

A local user inside a guest VM - that is, any tenant who has been handed a virtual machine. No host credentials and no access to the management network are needed.

What to do

Install the fixed qemu-kvm packages from your distribution (Red Hat tracks this across RHEL 6 through 10 and OpenShift Container Platform 4). The running QEMU process keeps the old code, so each guest has to be live-migrated or stopped and restarted before it is actually protected - in practice, drain the node's VMs onto patched hosts rather than patching in place and assuming it took effect.

References

Related entries

• Linux kernel BPF verifier: atomic-fetch precision gap lets equivalent-looking states be prunedCVE-2026-43009 · Linux kernel BPF verifier (precision backtracking for atomic fetch instructions)High
• Linux kernel sockmap: use-after-free of sk->sk_socket when an AF_UNIX peer is orphanedCVE-2026-43016 · Linux kernel BPF sockmap (sk_psock_verdict_data_ready)High
• Linux kernel BPF verifier: regsafe() wrongly prunes states when old range is BEYOND_PKT_ENDCVE-2026-43030 · Linux kernel BPF verifier (regsafe() packet pointer range comparison)High
• Linux kernel authencesn: out-of-place decrypt writes high-order sequence bits into the destination bufferCVE-2026-43033 · Linux kernel crypto API (authencesn template, out-of-place decryption)High
• Linux kernel AF_ALG: af_alg_pull_tsgl can reassign one page past the end of the scatterlistCVE-2026-43078 · Linux kernel crypto API (af_alg_pull_tsgl page reassignment)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-43206 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High