CVE-2026-120831

A flaw exists in libslirp within the if_output() function. When a session moves from the fast queue to the batch queue, the code incorrectly unlinks and reinserts an arbitrary packet via ifm->m_nextpkt instead of the session queue head. This leads to queue pointer corruption . A guest generati...