Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach VM with RSC-enabled virtio-net
-
DeliverySend crafted padded TCP segments
-
ExploitSegment cached with trailing padding intact
-
ExecutionCoalescing mis-computes buffer length
-
ImpactQEMU process corruption/crash (guest DoS)
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires a guest virtio-net device with Receive Segment Coalescing active (VIRTIO_NET_F_GUEST_RSC / RSC_EXT negotiated, typically Windows guests with LRO/RSC offload) and the ability to deliver crafted short, padding-bearing TCP segments to that guest. The bug lies in QEMU's host-side coalescing cache, so the exposed asset is the QEMU/hypervisor process, but it is gated by RSC negotiation - a non-default condition for many Linux guests - which is the primary limiting factor; crafting the padded-segment sequence adds complexity beyond a trivial single packet. |
| Impact | No CVSS vector, EPSS score, KEV entry, POC, or SSVC decision data was provided in the input, so quantitative exploitation signals are entirely absent and cannot be compared. Assessment therefore rests on the code path named in the commit title: QEMU's virtio-net Receive Segment Coalescing (RSC) logic in hw/net/virtio-net.c fails to strip trailing (Ethernet minimum-frame / L4) padding before caching a segment for coalescing, so cached-segment length accounting includes junk padding bytes. When later segments are merged, the padding corrupts the coalesced TCP stream or drives incorrect length math, which realistically manifests as a QEMU-process denial of service (crash/abort) and possibly guest-visible data corruption; memory-safety escalation cannot be ruled out but is not evidenced by the title alone. The product (QEMU) is extremely widely deployed, but the specific vulnerable path requires the RSC feature to be negotiated (predominantly Windows guests using LRO/RSC offload), which sharply narrows the real-world exposed population. Net: this reads as a moderate, DoS-leaning correctness/robustness fix rather than a high-urgency remote-code-execution priority, but with NO severity metrics supplied this is an inference from the code path and must be verified against the QEMU/Ubuntu advisory and the actual patch before any prioritization decision. Reporter is 'vendor:ubuntu' (Ubuntu Security), indicating distro tracking rather than confirmed in-the-wild abuse. |
| Exploit ScenarioDerived | A malicious network peer (or an attacker who can inject crafted traffic toward a VM) sends short TCP segments padded to the Ethernet minimum frame size to a guest whose virtio-net device has RSC/LRO coalescing negotiated. QEMU caches these segments without stripping the trailing padding and mis-handles length accounting during coalescing, corrupting the merged buffer and crashing (or corrupting data in) the QEMU host process serving that VM. No public exploit or POC was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
QEMU's virtio-net Receive Segment Coalescing (RSC) path mishandles short, padding-bearing TCP segments and fails to strip trailing padding before caching a coalesced segment, allowing crafted traffic to fault the host-side QEMU process and deny service to the guest it serves. The independently assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) describes a remote, unauthenticated trigger with high attack complexity, no confidentiality or integrity impact, and a scope-changed high availability impact on the hypervisor, which is more severe than a guest-local crash because the QEMU process also backs the VM's other devices. Exploitation is gated by the guest negotiating RSC (VIRTIO_NET_F_GUEST_RSC/RSC_EXT) - typically Windows guests with LRO/RSC offload enabled, whereas many Linux guests do not negotiate it by default - and by the attacker's ability to deliver a crafted sequence of padded segments, so the affected population is a subset of virtio-net users. No vendor CVSS score, EPSS value, CISA KEV entry, or public proof-of-concept was supplied with this report, and no public exploit has been identified at time of analysis.
RemediationAI
The upstream fix is the QEMU change submitted as 'hw/net/virtio-net: strip trailing padding when caching RSC segment'; apply the QEMU update published by your distribution (Ubuntu's qemu packages, per the vendor:ubuntu report, and equivalent packages from other vendors) as soon as it becomes available - the specific released fixed version is not confirmed in the provided data, so verify against the Ubuntu CVE tracker page for CVE-2026-66900 before assuming a given package revision is remediated; upstream fix available (commit-level); released patched version not independently confirmed. If patching must be deferred, the most direct compensating control is to eliminate the RSC negotiation that gates the bug: disable Receive Segment Coalescing / LRO inside affected guests (on Windows, Set-NetAdapterRsc -Enabled $false or Disable-NetAdapterRsc, and equivalently turn off the LRO/RSC offload in the virtual NIC's advanced properties), which closes the trigger path at the cost of higher guest CPU utilization and reduced bulk-receive throughput; where the hypervisor's device configuration allows masking the VIRTIO_NET_F_GUEST_RSC/RSC_EXT feature bits, that removes the trigger across all guests on the host at the same performance cost. Additional controls with their trade-offs: restrict which networks can send traffic to the guests (segmentation or firewall rules limiting inbound flows to trusted peers), which reduces but does not eliminate the ability to deliver crafted padded segments and may break legitimate connectivity; and, because the impacted asset is a host-side process, run guests under a supervisor that restarts QEMU on crash and monitor for unexpected QEMU terminations so that a triggered fault does not silently take down guest workloads. Note that confidentiality and integrity impact were assessed as none, so mitigations should prioritize availability and process resilience rather than data-exfiltration defenses.
Affected ProductsAI
QEMU builds that implement virtio-net RSC coalescing and expose the VIRTIO_NET_F_GUEST_RSC/RSC_EXT feature bits to guests; the input provides no CPE identifiers or explicit version ranges, so the affected set cannot be pinned to specific release numbers from the supplied data. The reporting source is the vendor:ubuntu channel, meaning Ubuntu's QEMU packages are in scope, and by extension other distributions shipping unpatched QEMU virtio-net code with RSC support. The practical exposure condition is a guest VM configured with an RSC/LRO-capable virtio-net NIC where the guest OS actually negotiates RSC - most commonly Windows guests with LRO/RSC offload enabled, while Linux guests frequently leave it off by default. Guests whose virtio-net devices do not negotiate the RSC feature are not reachable through this trigger, so the population at risk is the subset of virtio-net deployments with that offload active. Administrators should consult the Ubuntu security tracker entry for CVE-2026-66900 and their distribution's QEMU advisory to determine the exact fixed package versions applicable to their platform.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is QEMU's paravirtualized network device emulation (hw/net/virtio-net) and specifically its Receive Segment Coalescing / Large Receive Offload cache. RSC is a virtio feature negotiated through VIRTIO_NET_F_GUEST_RSC and the RSC_EXT configuration, letting the host coalesce multiple inbound TCP segments belonging to the same flow into a single large segment presented to the guest; the guest typically enables it via an OS offload setting (for example Windows LRO/RSC). The reported fix, 'strip trailing padding when caching RSC segment', indicates the defect is a length/padding accounting error in the host-side coalescing cache: when a segment shorter than the expected payload arrives with trailing padding, the padding was not removed before the segment was cached and coalesced, producing an inconsistent cached length for the host process. The input carries no CWE assignment, so the root-cause class is best described as improper handling of a length/padding mismatch in the coalescing buffer rather than a confirmed buffer overflow; the assessed impact profile (C:N/I:N/A:H with S:C) is consistent with a fault or crash of the emulation process rather than a demonstrated memory-corruption primitive for code execution. Because the emulation is host-side, the exposed asset is the QEMU process on the hypervisor, while the trigger originates from network traffic delivered to a guest that has RSC active - a non-default condition for many Linux guests and therefore the primary limiting factor on exploitability, compounded by the complexity of constructing the padded-segment sequence. No CPE strings or vendor CVSS vector were provided, so affected builds must be identified by feature support and distribution packaging rather than by CPE enumeration.
Know when Qemu gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Network-delivered crafted packets (AV:N) but requires RSC negotiated plus specific padded-segment sequencing (AC:H); guest-device bug crashing the host QEMU process crosses the VM boundary (S:C); impact assessed as availability/DoS (A:H).
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
DescriptionCVE.org
[hw/net/virtio-net: strip trailing padding when caching RSC segment]
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1. Rated critical severity (CVSS 10.0)
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote
The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achi
Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remot
Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU (aka Quick Emulator) allows attacke
QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA tra
softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_r
Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept
A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. Rated medium severity (CVSS 6.0), this vul
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, rela
A DMA reentrancy issue was found in the Tulip device emulation in QEMU. Rated high severity (CVSS 7.8), this vulnerabili
GitHub PoC
Exploit-DB