Qemu-kvm: vnc websocket handshake use-after-free

Summary

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

Timeline

1. Oct 3, 2025, 10:30 AM UTCCVE published
2. Oct 3, 2025, 3:56 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 9, 2026, 11:26 PM UTCRecord last updated

Affected versions

• qemu

  From 2.6.0 · fixed in 10.1.2

• qemu-kvm

  Version range not reported

• virt-devel:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• virt:rhel

  Version range not reported

• qemu-kvm

  Version range not reported

• qemu-kvm

  Version range not reported

• qemu-kvm

  Version range not reported

• qemu-kvm

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• qemu-kvm

  Version range not reported

• qemu-kvm

  Version range not reported

• qemu-kvm-ma

  Version range not reported

References 15