CVE-2010-0297: Buffer overflow in the usb_host_handle_control function in the USB passthrough handling implementation in u...

Security readout for executives and security teams

CVE-2010-0297 affects old QEMU USB passthrough handling. A user inside a guest operating system could send a crafted USB packet that crashes or hangs the guest and may allow code execution on the host. Business risk is highest where legacy KVM/QEMU hosts expose USB passthrough to untrusted or less-trusted guests. Exposure is likely limited to legacy QEMU/KVM deployments running QEMU before 0.11.1, or vendor builds lacking the backported fix, with USB passthrough enabled. Modern fully patched virtualization stacks are less likely exposed, but old appliances, lab hosts, and unmanaged hypervisors deserve review. Treat as high priority only where legacy QEMU/KVM with USB passthrough still exists. The issue is old, but the potential boundary break from guest to host makes unmanaged virtualization infrastructure worth checking promptly. Mitigation focus: Apply vendor QEMU/KVM updates, including relevant Red Hat advisory fixes where applicable.; Confirm QEMU is 0.11.1 or later, or has the vendor backport.; Disable USB passthrough for untrusted guests until patch status is verified..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.