Description
The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header, which bypasses a signed comparison.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | qemu-kvm | 0.12.5+dfsg-5+squeeze4 | DSA-2270-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | qemu-img +2 | 2:0.12.1.2-2.160.el6_1.2 | RHSA-2011:0919 |
Advisories 2
- DSA-2270-1 qemu-kvm - programming error Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2011:0919 Red Hat Security Advisory: qemu-kvm security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2011:0919 vendor-advisory
- 45170 third-party-advisory
- [oss-security] 20110628 CVE request: qemu-kvm: OOB memory access caused by negative vq notifies mailing-list
- 44648 third-party-advisory
- [oss-security] 20110629 Re: CVE request: qemu-kvm: OOB memory access caused by negative vq notifies mailing-list
- 45301 third-party-advisory
- 45158 third-party-advisory
- openSUSE-SU-2011:0803 vendor-advisory
- 74751 vdb-entry
- 44458 third-party-advisory
- USN-1165-1 vendor-advisory
- DSA-2270 vendor-advisory
- SUSE-SU-2011:0806 vendor-advisory
- http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commitdiff%3Bh=7157e2e23e89adcd436caeab31fdd6b47eded377