PT-2026-45205 · Unknown · Cloud Hypervisor

CVE-2026-45782 · Published 2026-05-30 · Updated 2026-06-10

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Cloud Hypervisor versions 21.0 through 51.1

Description A guest can cause a use-after-free in the cloud-hypervisor process by submitting two virtio-block descriptor chains that reuse the same head index while asynchronous block I/O (such as io uring or aio) is enabled. If the kernel completes the duplicate operation before the original, the completion path frees a bounce buffer that the kernel is still actively reading from or writing to, resulting in memory corruption.

Recommendations Update to version 51.2 or 52.0.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-45782

GHSA-F47P-P25Q-83RH

OPENSUSE-SU-2026:10907-1

Affected Products

Cloud Hypervisor

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45782.json · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2026:10907-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45782 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45782 · Security Note
• https://github.com/cloud-hypervisor/cloud-hypervisor/security/advisories/GHSA-f47p-p25q-83rh · Note
• https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v51.2 · Note
• https://github.com/cloud-hypervisor/cloud-hypervisor/pull/8220 · Note
• https://github.com/cloud-hypervisor/cloud-hypervisor/commit/1314ac883c641f1045bbb06dec0de045a3894baa · Note
• https://github.com/cloud-hypervisor/cloud-hypervisor/releases/tag/v52.0 · Note
• https://t.me/CVEtracker/56378 · Telegram Post
• https://suse.com/security/cve/CVE-2026-45782 · Note