{"api_version":"1","generated_at":"2026-04-23T03:26:58+00:00","cve":"CVE-2022-26354","urls":{"html":"https://cve.report/CVE-2022-26354","api":"https://cve.report/api/cve/CVE-2022-26354.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-26354","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-26354"},"summary":{"title":"CVE-2022-26354","description":"A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2022-03-16 15:15:00","updated_at":"2023-02-12 22:15:00"},"problem_types":["CWE-772"],"metrics":[],"references":[{"url":"https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf","name":"https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf","refsource":"MISC","tags":[],"title":"vhost-vsock: detach the virqueue element in case of error (8d1b247f) · Commits · QEMU / QEMU · GitLab","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://access.redhat.com/errata/RHSA-2022:5821","name":"https://access.redhat.com/errata/RHSA-2022:5821","refsource":"MISC","tags":[],"title":"Red Hat Customer Portal - Access to 24x7 support and knowledge","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.netapp.com/advisory/ntap-20220425-0003/","name":"https://security.netapp.com/advisory/ntap-20220425-0003/","refsource":"CONFIRM","tags":[],"title":"March 2022 QEMU Vulnerabilities in NetApp Products | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://access.redhat.com/security/cve/CVE-2022-26354","name":"https://access.redhat.com/security/cve/CVE-2022-26354","refsource":"MISC","tags":[],"title":"Red Hat Customer Portal - Access to 24x7 support and knowledge","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html","name":"[debian-lts-announce] 20220905 [SECURITY] [DLA 3099-1] qemu security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 3099-1] qemu security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://access.redhat.com/errata/RHSA-2022:5002","name":"https://access.redhat.com/errata/RHSA-2022:5002","refsource":"MISC","tags":[],"title":"Red Hat Customer Portal - Access to 24x7 support and knowledge","mime":"text/html","httpstatus":"200","archivestatus":"503"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063257","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2063257","refsource":"MISC","tags":[],"title":"2063257 – (CVE-2022-26354) CVE-2022-26354 QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.debian.org/security/2022/dsa-5133","name":"DSA-5133","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-5133-1 qemu","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://security.gentoo.org/glsa/202208-27","name":"GLSA-202208-27","refsource":"GENTOO","tags":[],"title":"QEMU: Multiple Vulnerabilities (GLSA 202208-27) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html","name":"[debian-lts-announce] 20220404 [SECURITY] [DLA 2970-1] qemu security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2970-1] qemu security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://access.redhat.com/errata/RHSA-2022:5263","name":"https://access.redhat.com/errata/RHSA-2022:5263","refsource":"MISC","tags":[],"title":"Red Hat Customer Portal - Access to 24x7 support and knowledge","mime":"text/html","httpstatus":"200","archivestatus":"503"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26354","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26354","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"26354","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"26354","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"26354","vulnerable":"1","versionEndIncluding":"6.2.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"qemu","cpe5":"qemu","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-26354","qid":"159862","title":"Oracle Enterprise Linux Security Update for qemu (ELSA-2022-9432)"},{"cve":"CVE-2022-26354","qid":"159880","title":"Oracle Enterprise Linux Security Update for kvm_utils (ELSA-2022-9460)"},{"cve":"CVE-2022-26354","qid":"159965","title":"Oracle Enterprise Linux Security Update for qemu-kvm (ELSA-2022-5263)"},{"cve":"CVE-2022-26354","qid":"160024","title":"Oracle Enterprise Linux Security Update for virt:ol and virt-devel:ol (ELSA-2022-5821)"},{"cve":"CVE-2022-26354","qid":"179172","title":"Debian Security Update for qemu (DLA 2970-1)"},{"cve":"CVE-2022-26354","qid":"179273","title":"Debian Security Update for qemu (DSA 5133-1)"},{"cve":"CVE-2022-26354","qid":"180995","title":"Debian Security Update for qemu (DLA 3099-1)"},{"cve":"CVE-2022-26354","qid":"198837","title":"Ubuntu Security Notification for QEMU Vulnerabilities (USN-5489-1)"},{"cve":"CVE-2022-26354","qid":"240530","title":"Red Hat Update for qemu-kvm (RHSA-2022:5263)"},{"cve":"CVE-2022-26354","qid":"240585","title":"Red Hat Update for virt:rhel and virt-devel:rhel security (RHSA-2022:5821)"},{"cve":"CVE-2022-26354","qid":"377638","title":"Alibaba Cloud Linux Security Update for virt:rhel and virt-devel:rhel (ALINUX3-SA-2022:0168)"},{"cve":"CVE-2022-26354","qid":"710604","title":"Gentoo Linux QEMU Multiple Vulnerabilities (GLSA 202208-27)"},{"cve":"CVE-2022-26354","qid":"752284","title":"SUSE Enterprise Linux Security Update for qemu (SUSE-SU-2022:2254-1)"},{"cve":"CVE-2022-26354","qid":"752288","title":"SUSE Enterprise Linux Security Update for qemu (SUSE-SU-2022:2260-1)"},{"cve":"CVE-2022-26354","qid":"753802","title":"SUSE Enterprise Linux Security Update for qemu (SUSE-SU-2023:0761-1)"},{"cve":"CVE-2022-26354","qid":"754898","title":"SUSE Enterprise Linux Security Update for qemu (SUSE-SU-2023:3721-1)"},{"cve":"CVE-2022-26354","qid":"754937","title":"SUSE Enterprise Linux Security Update for qemu (SUSE-SU-2023:3800-1)"},{"cve":"CVE-2022-26354","qid":"900769","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for qemu-kvm (9090)"},{"cve":"CVE-2022-26354","qid":"901981","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for qemu (9095)"},{"cve":"CVE-2022-26354","qid":"902109","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for qemu (9095-1)"},{"cve":"CVE-2022-26354","qid":"905206","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for qemu-kvm (9090-1)"},{"cve":"CVE-2022-26354","qid":"905868","title":"Common Base Linux Mariner (CBL-Mariner) Security Update for qemu-kvm (9090-2)"},{"cve":"CVE-2022-26354","qid":"940607","title":"AlmaLinux Security Update for virt:rhel and virt-devel:rhel (ALSA-2022:5821)"},{"cve":"CVE-2022-26354","qid":"940626","title":"AlmaLinux Security Update for qemu-kvm (ALSA-2022:5263)"},{"cve":"CVE-2022-26354","qid":"960299","title":"Rocky Linux Security Update for virt:rhel and virt-devel:rhel (RLSA-2022:5821)"}]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2022-26354","ASSIGNER":"secalert@redhat.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-772","cweId":"CWE-772"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"qemu-kvm","version":{"version_data":[{"version_affected":"=","version_value":"Affected QEMU versions <= 6.2.0"}]}}]}}]}},"references":{"reference_data":[{"url":"https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf","refsource":"MISC","name":"https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf"},{"url":"https://security.gentoo.org/glsa/202208-27","refsource":"MISC","name":"https://security.gentoo.org/glsa/202208-27"},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html","refsource":"MISC","name":"https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html"},{"url":"https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html","refsource":"MISC","name":"https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html"},{"url":"https://security.netapp.com/advisory/ntap-20220425-0003/","refsource":"MISC","name":"https://security.netapp.com/advisory/ntap-20220425-0003/"},{"url":"https://www.debian.org/security/2022/dsa-5133","refsource":"MISC","name":"https://www.debian.org/security/2022/dsa-5133"}]}},"nvd":{"publishedDate":"2022-03-16 15:15:00","lastModifiedDate":"2023-02-12 22:15:00","problem_types":["CWE-772"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":3.2,"baseSeverity":"LOW"},"exploitabilityScore":1.5,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:N/I:N/A:P","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":2.1},"severity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*","versionEndIncluding":"6.2.0","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}