An integer overflow or wraparound vulnerability exists in the virtio-snd device when processing PCM_INFO requests from a guest virtual machine. By supplying out-of-bounds stream counts, a malicious guest can cause the host to allocate memory without proper bounds, potentially leading to a denial of service condition. This vulnerability is identified as CVE-2026-3196 and affects version 8.2.0 of the affected software. The CVSS v3.1 base score is 5.5 (medium severity), with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vendor advisory from Red Hat does not currently specify a patch or remediation level.

The vulnerability allows a local attacker with privileges on a guest virtual machine to cause unbounded memory allocation on the host system by exploiting an integer overflow in the virtio-snd device. This can lead to a denial of service condition on the host, impacting availability. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-3196 for current remediation guidance. Until an official fix is available, consider restricting untrusted guest access or applying any vendor-recommended temporary mitigations if provided.