CVE-2026-16457
Public on 2026-08-16
Modified on 2026-08-16
Description
Virtqueue handler functions in device emulation code often look something like this:
while (!virtio_queue_empty(vq)) {
...pop and process virtqueue element...
}
virtio-blk, virtio-scsi, virtio-crypto, and vhost-shadow-virtqueue use this pattern.
The device may break (i.e. hit an error that requires device reset) during the loop. virtio_queue_empty() returns 1 for broken split vrings but not for broken packed vrings, leading to an infinite loop.
Adjust the packed vring behavior to match split vrings and avoid infinite loops.
while (!virtio_queue_empty(vq)) {
...pop and process virtqueue element...
}
virtio-blk, virtio-scsi, virtio-crypto, and vhost-shadow-virtqueue use this pattern.
The device may break (i.e. hit an error that requires device reset) during the loop. virtio_queue_empty() returns 1 for broken split vrings but not for broken packed vrings, leading to an infinite loop.
Adjust the packed vring behavior to match split vrings and avoid infinite loops.
Severity
See what this means
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | qemu | Not Affected | ||
| Amazon Linux 2023 | qemu | Not Affected | ||
| Amazon Linux 2 - Core | qemu-guest-agent | Not Affected | ||
| Amazon Linux 2 - Core | qemu-kvm | Not Affected |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 6.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |