Cloud Hypervisor CVE-2026-45782

Exploitation requires (1) the attacker to control a guest VM running on a vulnerable Cloud Hypervisor host (versions 21.0 through 51.1), (2) the guest disk to be configured with an asynchronous block I/O backend - specifically io_uring or libaio - since synchronous I/O paths do not trigger the race, and (3) the ability to submit two virtio-block descriptor chains that reuse the same head_index and to win the completion race so that the duplicate finishes before the original. No host authentication, no guest privilege escalation, and no user interaction on the host are required (PR:N/UI:N), but the AT:P flag and the description's 'when ... is enabled' phrasing mean default deployments using only sync I/O are not exposed; correspondingly, guests using read-only or non-block virtio devices, or VMs on already-patched 51.2/52.0 builds, are out of scope.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) accurately characterizes a guest-to-host attack: 'Local' here means the attacker operates from inside a VM (no host login or guest credentials required), Attack Requirements:Present reflects that asynchronous block I/O must be enabled, and Subsequent System Impact:High signals scope change from guest to hypervisor - i.e., a VM-escape-class primitive. In multi-tenant cloud deployments this is a top-tier risk because tenants are the threat model. EPSS and CISA KEV signals are absent from the provided data, and no public PoC is referenced, so real-world exploitation activity cannot be confirmed; however, use-after-frees in virtio paths are historically weaponizable (e.g., VENOM, CVE-2024-7589 patterns) and the upstream patch was issued promptly across both the 51.x and 52.x branches, which is consistent with a serious memory-safety bug rather than a theoretical one. Defenders running Cloud Hypervisor with io_uring or aio enabled should treat this as priority-patch material; defenders on sync I/O only are not exposed by the description.

A malicious tenant inside a guest VM crafts two virtio-block descriptor chains that reuse the same head_index and submits them in quick succession against a disk backed by io_uring or aio; when the kernel completes the duplicate before the original, the VMM frees the bounce buffer while the kernel is still reading from or writing to it, corrupting heap memory in the cloud-hypervisor host process. With careful heap grooming this use-after-free is a plausible stepping stone to host-side code execution and VM escape, though no public exploit is identified at time of analysis.