{"id":"CVE-2026-120831","kind":"vulnerability","aliases":["CVE-2026-120831"],"related":[],"title":"libslirp: queue corruption in if_output() lets a guest crash host networking","description":"A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.","summary":"libslirp, the user-mode networking library used by QEMU and similar tools, corrupts its packet queue pointers when moving a session between queues. A guest that generates burst traffic can crash the host networking process, causing denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","libslirp","qemu","self-hosted","virtualization"],"not_affected_if":["no-user-mode-networking","trusted-guests-only"],"how_to_check":"- Check whether the host runs QEMU or another tool built on libslirp, for example with `qemu-system-x86_64 --version` and `ldd $(which qemu-system-x86_64) | grep slirp`\n- Note whether guests use user-mode networking (`-netdev user`) rather than a bridge or tap device","fix":null,"status":"open","published_at":"2026-11-03T02:16:53+00:00","first_seen_at":"2026-11-03T02:47:45+00:00","triaged_at":"2026-11-03T02:48:57+00:00","updated_at":"2026-11-03T02:48:57+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T02:48:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"libslirp: queue corruption in if_output() lets a guest crash host networking","impact":"low","summary":"libslirp, the user-mode networking library used by QEMU and similar tools, corrupts its packet queue pointers when moving a session between queues. A guest that generates burst traffic can crash the host networking process, causing denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["libslirp","qemu","virtualization","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"guest traffic crashes the host networking process, denying service","analyst_note":"Find the affected and fixed libslirp versions and the upstream commit in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120831.","how_to_check":"- Check whether the host runs QEMU or another tool built on libslirp, for example with `qemu-system-x86_64 --version` and `ldd $(which qemu-system-x86_64) | grep slirp`\n- Note whether guests use user-mode networking (`-netdev user`) rather than a bridge or tap device","plain_action":"","needs_analyst":true,"not_affected_if":["no-user-mode-networking","trusted-guests-only"],"who_is_affected":"Systems that run guest virtual machines with libslirp user-mode networking on the host. The sources do not name affected libslirp versions or a fixed release. Hosts using only bridged or tap networking, or with no untrusted guests, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4116,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120831':15A,18A '-2026':14A,17A 'arbitrari':93C 'batch':85C 'burst':54B,111C 'caus':62B,119C 'code':88C 'corrupt':3A,39B,105C 'could':113C 'crash':10A,57B,114C 'cve':13A,16A 'denial':63B,121C 'fast':81C 'flaw':67C 'found':69C 'generat':53B,110C 'guest':9A,51B,109C 'head':104C 'host':11A,24B,59B,116C 'ifm':96C 'infrastructur':19B 'instead':99C 'let':7A 'librari':32B 'libslirp':1A,20B,26B,71C 'm':97C 'mode':30B 'move':45B,76C 'network':12A,31B,60B,117C 'nextpkt':98C 'output':6A,74C 'packet':41B,94C 'pointer':43B,107C 'process':61B,118C 'qemu':21B,35B 'queue':2A,42B,49B,82C,86C,103C,106C 'reinsert':91C 'self':23B 'self-host':22B 'servic':65B,123C 'session':47B,78C,102C 'similar':37B 'tool':38B 'traffic':55B,112C 'unlink':89C 'use':33B 'user':29B 'user-mod':28B 'via':95C 'virtual':25B","nicknames":[],"mitigations":[],"who_affected":"Systems that run guest virtual machines with libslirp user-mode networking on the host. The sources do not name affected libslirp versions or a fixed release. Hosts using only bridged or tap networking, or with no untrusted guests, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","libslirp","medium","qemu","selfhosted","virtualization"],"first_public_at":"2026-11-03T02:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120831","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120831","severity":null,"published_at":"2026-11-03T02:16:53+00:00","modified_at":"2026-11-03T02:16:53+00:00","first_seen_at":"2026-11-03T02:47:45+00:00","fetched_at":"2026-11-03T02:47:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}