This vulnerability involves a stack-based buffer overflow in the QEMU e1000 network device's receive code. The padding logic for short frames was moved to the net core code, but the e1000 device still processes short frames in loopback mode, which can cause a buffer overrun in the e1000_receive_iov() function. Exploitation by a malicious guest user could crash the QEMU process on the host system, resulting in denial of service. The vulnerability affects Red Hat Enterprise Linux 10 version 8.1.0. No known exploits in the wild have been reported. The vendor advisory from Red Hat is available but does not explicitly state patch availability.

Successful exploitation leads to a denial of service by crashing the QEMU process on the host. There is no indication of confidentiality or integrity impact. The vulnerability requires local access with the ability to send crafted network frames in loopback mode within the guest environment.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2025-12464 for current remediation guidance. Until a patch is applied, consider restricting guest user capabilities to prevent sending malicious frames in loopback mode if feasible.