CVE-2022-26353

    Dashboard / Vulnerabilities / CVE-2022-26353

    CVE-2022-26353

    Published: 16 Mar 2022Last Modified: 12 Aug 2026

    Summary:

    Details: A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and other unexpected results. Affected QEMU version: 6.2.0.

    References: https://lists.nongnu.org/archive/html/qemu-devel/2022-03/msg02438.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26353.json, https://nvd.nist.gov/vuln/detail/CVE-2022-26353, https://security.gentoo.org/glsa/202208-27, https://security.netapp.com/advisory/ntap-20220425-0003/, https://www.debian.org/security/2022/dsa-5133, https://gitlab.com/qemu-project/qemu/-/commit/abe300d9d894f7138e1af7c8e9c88c04bfe98b37

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 44f28df24767cf9dca1ddc9b23157737c4cbb645
    Fixed -None

    Affected versions

    6.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High