{"id":"CVE-2026-120831","title":"Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service","summary":"A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointe…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Red Hat","product":"libslirp","affected":["libslirp (all versions)","container-tools:rhel8/libslirp (all versions)","libslirp (all versions)","libslirp (all versions)","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T15:08:22.096729Z"},"published":"2026-11-03","updated":"2026-11-05","sourceUpdated":"2026-11-05T19:03:11.989Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120831","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-120831"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565425","label":"RHBZ#2565425"},{"url":"https://gitlab.freedesktop.org/slirp/libslirp/-/commit/bad35bd3b529dc47aa109980a69a36da7848ab76"}],"tags":["cve.org"],"epss":0.00265,"epssPercentile":0.1855,"ingestedAt":"2026-11-05T22:38:31.492Z","slug":"CVE-2026-120831","body":"## Overview\n\nA flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.\n\n## Affected\n\n- `libslirp (all versions)`\n- `container-tools:rhel8/libslirp (all versions)`\n- `libslirp (all versions)`\n- `libslirp (all versions)`\n- `openshift/ose-rhel-coreos-8 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nRed Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}