PT-2026-135852

A flaw was found in libslirp in if output. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-m nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...