---
id: CVE-2026-120831
title: >-
  Libslirp: libslirp: queue pointer corruption in if_output() leading to denial
  of service
summary: >-
  A flaw was found in libslirp in if_output(). When moving a session from the
  fast queue to the batch queue, the code unlinked and reinserted an arbitrary
  packet via ifm->m_nextpkt instead of the session queue head, corrupting queue
  pointe…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-787
vendor: Red Hat
product: libslirp
affected:
  - libslirp (all versions)
  - 'container-tools:rhel8/libslirp (all versions)'
  - libslirp (all versions)
  - libslirp (all versions)
  - openshift/ose-rhel-coreos-8 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T15:08:22.096729Z'
published: '2026-11-03'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:03:11.989Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120831'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-120831'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2565425'
    label: RHBZ#2565425
  - url: >-
      https://gitlab.freedesktop.org/slirp/libslirp/-/commit/bad35bd3b529dc47aa109980a69a36da7848ab76
tags:
  - cve.org
epss: 0.00265
epssPercentile: 0.1855
ingestedAt: '2026-11-05T22:38:31.492Z'
---

## Overview

A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.

## Affected

- `libslirp (all versions)`
- `container-tools:rhel8/libslirp (all versions)`
- `libslirp (all versions)`
- `libslirp (all versions)`
- `openshift/ose-rhel-coreos-8 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.