CVE-2026-16457

Public on 2026-08-16
Modified on 2026-08-16
Description
Virtqueue handler functions in device emulation code often look something like this:

while (!virtio_queue_empty(vq)) {
...pop and process virtqueue element...
}

virtio-blk, virtio-scsi, virtio-crypto, and vhost-shadow-virtqueue use this pattern.

The device may break (i.e. hit an error that requires device reset) during the loop. virtio_queue_empty() returns 1 for broken split vrings but not for broken packed vrings, leading to an infinite loop.

Adjust the packed vring behavior to match split vrings and avoid infinite loops.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
6.5
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core qemu Not Affected
Amazon Linux 2023 qemu Not Affected
Amazon Linux 2 - Core qemu-guest-agent Not Affected
Amazon Linux 2 - Core qemu-kvm Not Affected

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H