CVE-2012-2693: libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple dev...

Security readout for executives and security teams

This flaw can make a virtualization host attach the wrong USB device to a virtual machine when multiple USB devices share the same vendor and product IDs. A local user could receive access to a device they were not intended to use. Business impact depends on whether sensitive USB devices are passed into guests. Exposure is most likely on virtualization hosts using libvirt USB passthrough, especially where multiple identical USB devices are attached. Hosts without USB device assignment to guests have limited practical exposure based on the supplied sources. Prioritize environments where VMs can access physical USB devices, especially shared virtualization hosts or regulated workloads. This is not broadly internet-exposed, but it can undermine device isolation and data handling controls if sensitive USB devices are present. Mitigation focus: Identify libvirt hosts that pass USB devices into guests.; Apply vendor libvirt updates referencing CVE-2012-2693, including relevant Red Hat advisories where applicable.; Avoid USB passthrough configurations relying only on duplicate vendor/product IDs..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.