Description (CNA)
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 2.6.0 before 10.1.2 |
| Red Hat / Red Hat Enterprise Linux 10 | unaffected 18:10.0.0-14.el10_1.5 before * |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 8100020251120003312.489197e6 before * |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 8100020251202222937.489197e6 before * |
| Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | unaffected 8040020260916092751.522a0ee4 before * |
| Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | unaffected 8040020260916092751.522a0ee4 before * |
| Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service | unaffected 8080020260910092120.63b34585 before * |
| Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | unaffected 8080020260910092120.63b34585 before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 17:10.1.0-17.el9_8 before * |
| Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | unaffected 17:6.2.0-11.el9_0.10 before * |
| Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | unaffected 17:7.2.0-14.el9_2.24 before * |
| Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Support | unaffected 17:8.2.0-11.el9_4.18 before * |
| Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Support | unaffected 17:8.2.0-11.el9_4.19 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.12 | unaffected 412.86.202608241157-0 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.16 | unaffected 416.94.202601071926-0 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.17 | unaffected 417.94.202601120213-0 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.18 | unaffected 418.94.202601071817-0 before * |
| Red Hat / Red Hat Enterprise Linux 6 | unaffected |
| Red Hat / Red Hat Enterprise Linux 7 | unaffected |
| Red Hat / Red Hat Enterprise Linux 7 | affected |
CWE
CWE-416
References
- https://access.redhat.com/errata/RHSA-2025:23228
- https://access.redhat.com/errata/RHSA-2026:0326
- https://access.redhat.com/errata/RHSA-2026:0332
- https://access.redhat.com/errata/RHSA-2026:0702
- https://access.redhat.com/errata/RHSA-2026:1831
- https://access.redhat.com/errata/RHSA-2026:18772
- https://access.redhat.com/errata/RHSA-2026:22147
- https://access.redhat.com/errata/RHSA-2026:3077
- https://access.redhat.com/errata/RHSA-2026:3165
- https://access.redhat.com/errata/RHSA-2026:5578
- https://access.redhat.com/errata/RHSA-2026:59831
- https://access.redhat.com/errata/RHSA-2026:68513
- https://access.redhat.com/errata/RHSA-2026:69131
- https://access.redhat.com/security/cve/CVE-2025-11234
- https://bugzilla.redhat.com/show_bug.cgi?id=2401209
ADP enrichment
No English description supplied.
No references supplied.