This vulnerability involves an integer overflow in the virtio-snd device when processing PCM_INFO requests from a guest virtual machine. The overflow can cause the host to allocate an unbounded amount of memory, resulting in a denial of service condition. The vulnerability has a CVSS 3.1 base score of 5.5 with local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. Red Hat's advisory states that their qemu-kvm packages are not affected because the virtio-snd device is disabled at build-time in Red Hat Enterprise Linux, removing the attack surface. No official patch or remediation level is currently provided.

The vulnerability can cause a denial of service on the host system by triggering unbounded memory allocation through malicious PCM_INFO requests from a guest. There is no confidentiality or integrity impact reported. The attack requires local access with low privileges and no user interaction. Red Hat's affected products are not vulnerable due to the virtio-snd device being disabled at build-time.

Red Hat states that their qemu-kvm packages as shipped are not affected because the virtio-snd device is disabled at build-time, effectively removing the attack surface. Therefore, no action is required for Red Hat Enterprise Linux users. For other environments where virtio-snd is enabled, monitor vendor advisories for patches or mitigations. Patch status is not yet confirmed for other vendors—check the vendor advisory for current remediation guidance.