CVE-2025-12464: QEMU e1000 Network Device DOS Vulnerability

CVE-2025-12464 Overview

CVE-2025-12464 is a stack-based buffer overflow [CWE-121] in the QEMU e1000 emulated network device. Maintainers moved short-frame padding out of individual network devices and into the shared net core code. The e1000 receive path, however, still processes short frames when operating in loopback mode. This oversight allows a short frame to reach e1000_receive_iov() without padding, producing a stack buffer overrun. A malicious guest user can trigger the flaw to crash the QEMU process on the host, resulting in denial of service against the virtualization stack.

Critical Impact
A local guest user can crash the host QEMU process, disrupting the virtual machine and any workloads dependent on it.

Affected Products

QEMU emulator with the e1000 network device model
Linux distributions shipping vulnerable QEMU packages (see Red Hat CVE-2025-12464 Advisory)
Virtualization stacks using QEMU/KVM with e1000 NIC emulation

Discovery Timeline

2025-10-31 - CVE-2025-12464 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2025-12464

Vulnerability Analysis

QEMU emulates an Intel e1000 gigabit Ethernet controller for guest virtual machines. The device supports a loopback mode in which transmitted frames are looped back into the receive path without leaving the host. The receive routine e1000_receive_iov() assumes incoming frames meet Ethernet's 60-byte minimum length, since padding was historically applied by each device model.

When the QEMU project consolidated short-frame padding into the net core, the e1000 loopback path was left able to hand off undersized frames directly to the receive code. The receive code then performs buffer operations sized against the expected minimum, writing past the intended stack buffer boundary. The result is stack memory corruption in the QEMU host process.

Root Cause

The root cause is inconsistent enforcement of the Ethernet minimum frame length after padding logic was centralized. The e1000 loopback code path bypasses the net core's padding, leaving e1000_receive_iov() exposed to short frames it was never rewritten to handle safely. This is a classic stack-based buffer overflow condition classified under [CWE-121].

Attack Vector

Exploitation requires local access as a guest user inside a virtual machine using the e1000 network device. The attacker crafts a short frame and directs it through the loopback code path within the guest. QEMU processes the undersized frame on the host, and the buffer overrun corrupts stack memory, crashing the QEMU process. The vector is local to the guest, requires no authentication to QEMU itself, and produces high availability impact without disclosing data or altering integrity. Refer to QEMU Project Issue #3043 for reproduction details.

Detection Methods for CVE-2025-12464

Indicators of Compromise

Unexpected termination of qemu-system-x86_64 or related QEMU processes on virtualization hosts
Guest VM outages accompanied by QEMU segmentation faults in host logs
Core dumps referencing e1000_receive_iov in the crashing call stack

Detection Strategies

Monitor host kernel and systemd journals for QEMU process crashes correlated with guest network activity
Inventory running VMs that use the e1000 NIC model and flag them for prioritized patching
Alert on repeated QEMU restarts driven by libvirt or the hypervisor management layer

Monitoring Recommendations

Ingest hypervisor host logs and QEMU crash telemetry into a centralized analytics platform for correlation
Track package versions of QEMU across the fleet to identify unpatched hosts
Watch for anomalous guest-initiated network patterns targeting the e1000 loopback path

How to Mitigate CVE-2025-12464

Immediate Actions Required

Apply vendor-supplied QEMU updates as soon as they are available from your Linux distribution
Identify guests configured with the e1000 NIC and reassess whether they require that device model
Restrict guest administrative access on multi-tenant hosts until patches are deployed

Patch Information

Monitor the Red Hat CVE-2025-12464 Advisory and the upstream QEMU Project Issue #3043 for the fix that reinstates short-frame padding in the e1000 loopback path. Refer to Red Hat Bug Report #2408845 for downstream tracking.

Workarounds

Switch affected guests to an alternative NIC model such as virtio-net or e1000e where compatible
Limit the ability of untrusted guest users to configure or exercise loopback network paths
Run QEMU with hardening compilers and stack protectors enabled to reduce exploit reliability

bash

# Configuration example: switch guest NIC model in libvirt domain XML
# Replace <model type='e1000'/> with virtio-net in the <interface> block
# <interface type='network'>
#   <source network='default'/>
#   <model type='virtio'/>
# </interface>
virsh edit <domain-name>