CVE-2026-115449
Description
A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.
Statement
Red Hat has assessed this issue and confirmed a low-severity information disclosure. When the SOCK_DGRAM ICMP socket path is unavailable (ping_group_range restricted, which forces a raw socket fallback) and the guest pings a nonexistent host on the hypervisor's LAN, the host's real IP address can be leaked to the guest in the ICMP echo reply payload. This breaks NAT isolation but does not disclose arbitrary host heap memory as originally reported. The impact is limited to host IP address disclosure (4 bytes of network metadata). The normal SOCK_DGRAM ICMP path (used when ping_group_range is permissive) is not affected.
Mitigation
Ensure that the QEMU process user's GID is included in the system's ping_group_range (sysctl net.ipv4.ping_group_range), which allows the SOCK_DGRAM ICMP socket path and avoids the vulnerable raw socket fallback. Alternatively, use --net none or virtio-net with a TAP backend instead of user-mode (slirp) networking.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.5 | N/A | 3.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Red Hat CVSS v3 Score Explanation
NAT info leak: host real IP disclosed to guest via ICMP unreachable on raw socket fallback path. Not heap memory disclosure.
Acknowledgements
Red Hat would like to thank Piyusha Akash for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
