CVE-2026-0665: QEMU KVM Xen Guest Support DoS Vulnerability

CVE-2026-0665 Overview

An off-by-one error was discovered in QEMU's KVM Xen guest support that enables malicious guests to trigger out-of-bounds heap accesses. This vulnerability exists within the emulated Xen physdev hypercall interface, allowing attackers with local access from within a guest virtual machine to corrupt heap memory in the QEMU process, potentially leading to denial of service or memory corruption.

Critical Impact

A malicious guest VM can exploit this off-by-one error to trigger out-of-bounds heap writes in the QEMU hypervisor process, potentially crashing the host or corrupting memory.

Affected Products

• QEMU with KVM Xen guest support enabled
• Linux-based virtualization platforms using QEMU/KVM with Xen emulation
• Systems running Xen-compatible guest operating systems under QEMU

Discovery Timeline

• 2026-02-18 - CVE-2026-0665 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-0665

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-bounds Write), which occurs when the software writes data past the end, or before the beginning, of the intended buffer. In this case, an off-by-one error in the Xen physdev hypercall emulation code allows a malicious guest to manipulate hypercall parameters in a way that causes the QEMU process to write beyond allocated heap boundaries.

The off-by-one error is a common programming mistake where a loop iterates one time too many or too few, or where an array index calculation is off by one position. In virtualization contexts, such errors are particularly dangerous as they can allow a guest VM to compromise the host system's hypervisor process.

Root Cause

The root cause is an off-by-one boundary check error in QEMU's implementation of the Xen physdev hypercall interface for KVM guests. When processing certain hypercall requests from Xen-compatible guests, the boundary validation logic incorrectly allows access to one element beyond the intended heap buffer allocation. This off-by-one miscalculation enables controlled out-of-bounds memory access.

Attack Vector

The attack requires local access from within a guest virtual machine running on an affected QEMU/KVM host with Xen guest support enabled. An attacker must have the ability to execute code within the guest OS and make hypercalls to the emulated Xen physdev interface. By crafting specific physdev hypercall parameters, the attacker can trigger the off-by-one error and cause out-of-bounds heap access in the QEMU process running on the host.

This is a local attack vector that requires low privileges within the guest but can affect the host hypervisor process, representing a potential guest-to-host escape scenario. The vulnerability can be exploited to cause denial of service through QEMU process crashes or potentially achieve more severe impacts through heap memory corruption.

Detection Methods for CVE-2026-0665

Indicators of Compromise

• Unexpected QEMU process crashes or segmentation faults on the host system
• Heap corruption errors in QEMU logs or system crash dumps
• Unusual hypercall activity from Xen-compatible guest VMs
• Memory access violation errors related to physdev hypercall handling

Detection Strategies

• Monitor QEMU process stability and capture crash dumps for analysis
• Implement memory debugging tools (such as AddressSanitizer) in development/staging environments to detect heap overflows
• Review system logs for QEMU crashes that reference Xen physdev or hypercall code paths
• Use host-based intrusion detection to identify anomalous guest VM behavior

Monitoring Recommendations

• Enable detailed logging for QEMU processes handling Xen-compatible guests
• Configure alerting on unexpected QEMU process terminations
• Monitor memory utilization patterns of hypervisor processes
• Implement crash analysis tooling to identify patterns consistent with this vulnerability

How to Mitigate CVE-2026-0665

Immediate Actions Required

• Review and update QEMU installations to the latest patched version when available
• Consider disabling Xen guest support in QEMU configurations if not required
• Limit access to virtualization infrastructure to trusted administrators
• Isolate critical workloads from potentially malicious guest VMs

Patch Information

Consult the Red Hat CVE-2026-0665 Advisory for official patch information and updates. Additional technical details can be found in Red Hat Bug Report #2428640. Organizations should monitor their Linux distribution vendor channels for security updates addressing this vulnerability.

Workarounds

• Disable Xen guest emulation support in QEMU if not operationally required by removing or disabling the -xen-domid and related Xen options
• Implement strict guest isolation policies to limit the impact of potentially compromised VMs
• Use seccomp filtering or AppArmor/SELinux profiles to restrict QEMU process capabilities
• Consider migrating critical workloads to hosts without Xen guest compatibility enabled until patches are applied

# Verify Xen guest support status in QEMU configuration
# Check if Xen-specific options are enabled in VM configurations
grep -r "xen" /etc/libvirt/qemu/*.xml

# Disable Xen guest support by removing Xen-related parameters from QEMU command lines
# Review and modify VM definitions to remove: -xen-domid, -xen-attach options