CVE-2022-26354

LowCVSS 3.2/10Last modified Jun 17, 2026

Description

A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0.

Metrics

CVSS 3.1 3.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L

Weakness enumeration

CWE-772

Affected software

Vendor	Product	Versions
n/a	qemu-kvm	Affected QEMU versions <= 6.2.0

References

https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aafPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/04/msg00002.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202208-27Third Party Advisory
https://security.netapp.com/advisory/ntap-20220425-0003/Third Party Advisory
https://www.debian.org/security/2022/dsa-5133Third Party Advisory
https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aafPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/04/msg00002.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202208-27Third Party Advisory
https://security.netapp.com/advisory/ntap-20220425-0003/Third Party Advisory
https://www.debian.org/security/2022/dsa-5133Third Party Advisory

Timeline

Published: Mar 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-263554.4Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a registration authority cer CVE-2022-263565.6Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram CVE-2022-263577.0race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID CVE-2022-263587.8IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which asp CVE-2022-263597.8IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which asp CVE-2022-26368.8Improper Control of Generation of Code ('Code Injection') in GitHub repository hestiacp/hestiacp prior to 1.6.6.CVE-2022-263607.8IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which asp CVE-2022-263617.8IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which asp CVE-2022-263626.4x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This CVE-2022-263636.7x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/CVE-2022-263646.7x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/CVE-2022-263657.1Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities c