CVE-2026-45782
HIGH
8,9
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. From version 21.0 to before version 51.2, a guest can cause a use-after-free in the cloud-hypervisor process by submitting two virtio-block descriptor chains that reuse the same head_index while asynchronous block I/O is enabled (e.g. io_uring, aio). When the kernel completes the duplicate operation before the original, the completion path frees a bounce buffer that the kernel is still actively reading from or writing to, corrupting the freed memory. This issue has been patched in versions 51.2 and 52.0.
416
Use After Free
StableCommon Consequences
Security Scopes Affected:
Integrity
Availability
Confidentiality
Potential Impacts:
Modify Memory
Dos: Crash, Exit, Or Restart
Read Memory
Execute Unauthorized Code Or Commands
Applicable Platforms
Languages:
Memory-Unsafe, C, C++
https://github.com/cloud-hypervisor/cloud-hypervisor/commit/1314ac883c641f1045b…
https://github.com/cloud-hypervisor/cloud-hypervisor/pull/8220
https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v51.2
https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v52.0
https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-f…