libslirp: Denial of service in if_output (CVE-2026-120831)
A queue pointer corruption vulnerability in libslirp allows an adjacent attacker to crash the host networking process via burst traffic, leading to a denial of service.
CVE search metadata
CVE search record: CVE-2026-120831. Severity: medium. CVSS: 6.5. KEV: no. Product: libslirp. Brief: libslirp: Denial of service in if_output (CVE-2026-120831). Brief link: https://feed.craftedsignal.io/briefs/2026-11-libslirp-denial-of-service/
Triage facts
Revision 1- Applicability
- libslirp
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 4 public sources
- Freshness
- Revision 1Nov 3, 04:05 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability exists in the libslirp library within the if_output() function, identified as CVE-2026-120831. An attacker can trigger memory corruption when the library attempts to move a session from the fast queue to the batch queue. By unlinking and reinserting an arbitrary packet via ifm->m_nextpkt instead of the session queue head, the library corrupts internal queue pointers.
Impact
Successful exploitation results in a crash of the host networking process, leading to a denial of service for the affected host. This impact is confirmed by the Red Hat bugzilla report.
Recommendation
- Inventory systems utilizing libslirp, particularly virtual machine hosts or container runtimes relying on this user-mode networking library.
- Review the provided Red Hat Bugzilla report and Gitlab commit for patch availability or mitigating configuration changes.
- Prioritize patching for internet-facing or multi-tenant virtualization environments where an adjacent attacker could potentially reach the interface.
Threat Hunt
Monitor for unexpected termination or restart of virtualization networking processes (e.g., qemu, libvirtd) coinciding with high network traffic spikes
Data: Host system logs (dmesg, syslog, journalctl), Virtualization management service logs
Mitigations
Identify and patch libslirp components in virtualized environments
CVE-2026-120831