The vulnerability in QEMU's vhost inflight migration VMState handling involves an incorrect conversion between numeric types. Specifically, the destination buffer size is stored as a 64-bit unsigned integer but read as a 32-bit signed integer during VMState deserialization. On little-endian systems, a crafted migration state with bit 31 set causes the size to be interpreted as negative, which is then implicitly converted to a very large size_t value. This leads to qemu_get_buffer() copying migration-stream data beyond the bounds of the mmap-backed inflight region, resulting in potential process crashes or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration. Disabling the inflight parameter in the vhost-user device configuration prevents the vulnerable code path from being reached.

The vulnerability can cause a denial of service by crashing the QEMU process or lead to memory corruption. There is no impact on confidentiality or integrity according to the CVSS vector. Exploitation requires high privileges and control over the migration producer or write access to the migration channel, limiting the attack surface. The availability impact is rated high due to potential crashes.

If vhost inflight migration is not required, disable it by omitting the inflight parameter from the vhost-user device configuration to prevent the vulnerable VMState deserialization path from being reached. For environments that require vhost inflight migration, this mitigation is not applicable and applying the vendor fix when released should be prioritized. Patch status is not yet confirmed—check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6426 for current remediation guidance.