Answer in brief
CVE-2024-8612 records a Low severity (CVSS 3.8) vulnerability in Qemu-kvm: information leak in virtio devices. The current sources do not mark it as known exploited. The current feed maps Red Hat/qemu-kvm (generic), Red Hat/virt:av/qemu-kvm (generic), Red Hat/virt:rhel/qemu-kvm (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 3.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Red Hat/qemu-kvm (generic), Red Hat/virt:av/qemu-kvm (generic), Red Hat/virt:rhel/qemu-kvm (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Red Hat/qemu-kvmgeneric | * | Not reported |
| Red Hat/virt:av/qemu-kvmgeneric | * | Not reported |
| Red Hat/virt:rhel/qemu-kvmgeneric | * | Not reported |
Published upstream
Sep 20, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 6, 2026
A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.
Quoted source text, attributed separately from HOL analysis.