CVE-2026-16043

CVE Details

Release Date:	2026-09-03
Impact:	Important	What is this?

Description

In QEMU's sysbus-xhci (USB 3.0 host controller) emulation (hw/usb/hcd-xhci.c, hw/usb/hcd-xhci-sysbus.c), an out-of-bounds heap access vulnerability exists in the xhci_sysbus_intr_ raise() function. Some machine types (e.g., microvm) instantiate a sysbus-xhci device with only 1 interrupt by setting the "intrs" property to 1, causing xhci_sysbus_realize() to allocate the s->irq array with a single entry. When the guest writes to the ERDP register of an XHCI interrupter with index n > 0, the generic XHCI code calls xhci_sysbus_intr_raise( ) with an out-of-bounds index, accessing s->irq[n] at a bad heap address. The subsequent qemu_set_irq() call then invokes an IRQ handler via a function pointer read from that corrupted heap location, potentially leading to a QEMU crash (segmentation fault) or arbitrary code execution if the pointer targets executable memory. Fixed in QEMU v11.0.3 and v10.0.12.

See more information about CVE-2026-16043 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	8.2
Vector String:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	High
User Interaction:	None
Scope:	Changed
Confidentiality Impact:	High
Integrity Impact:	High
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (qemu-kvm)	ELSA-2026-500245	2026-09-03