Cloud Hypervisor: Use-after-free in virtio-block Async I/O Completion
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.
Summary
Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. From version 21.0 to before version 51.2, a guest can cause a use-after-free in the cloud-hypervisor process by submitting two virtio-block descriptor chains that reuse the same head_index while asynchronous block I/O is enabled (e.g. io_uring, aio). When the kernel completes the duplicate operation before the original, the completion path frees a bounce buffer that the kernel is still actively reading from or writing to, corrupting the freed memory. This issue has been patched in versions 51.2 and 52.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cloud-hypervisor | cloud-hypervisor | 21.0 to before 51.2 | 51.2 | Patch available | CNA |
- cloud-hypervisor Vendorcloud-hypervisor Affected 21.0 to before 51.2 Fixed in 51.2 Patch available CNA
Remediation
- Fix · CNA cloud-hypervisor (cloud-hypervisor) Fixed in 51.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-45782
- 2026-10-25 Priority changed: MEDIUM → LOW
References
Other 5
- https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-f47p-p25q-83rh
- https://github.com/cloud-hypervisor/cloud-hypervisor/pull/8220
- https://github.com/cloud-hypervisor/cloud-hypervisor/commit/1314ac883c641f1045bbb06dec0de045a3894baa
- https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v51.2
- https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v52.0
More cloud-hypervisor vulnerabilities
- TI-2026-21644 Cloud Hypervisor: Host File Exfiltration via QCOW Backing File Abuse CVSS 4.0CRITICAL 9.1
- TI-2023-14428 Malicious HTTP requests could close arbitrary opening file descriptors in cloud-hypervisor CVSS 3.1MEDIUM 4.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences