Medium
6.5
Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
CVE-2026-120831
First seen on SecPulse
Fix status by distribution
Records published by each distribution for this CVE. Fixed versions differ by release; check each link.
- Debian DEBIAN-CVE-2026-120831 libslirp No fixed version in this record
- Ubuntu UBUNTU-CVE-2026-120831 libslirp No fixed version in this record
Original description The description as published by the source.
A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory access.redhat.com
- advisory nvd.nist.gov
- advisory github.com
- patch gitlab.freedesktop.org
- report bugzilla.redhat.com
- web github.com
- web access.redhat.com