CVE-2016-2391: The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local gues...

Security readout for executives and security teams

CVE-2016-2391 is a QEMU virtualization flaw that can let an administrator inside a guest VM crash the QEMU process on the host. The reported impact is denial of service, not data theft or code execution. Business urgency is highest where untrusted or semi-trusted tenants can administer guest systems. Exposure is most relevant to QEMU deployments using USB OHCI emulation where guest OS administrators are not fully trusted. Single-tenant systems with trusted guest administrators have lower practical risk. The bundle does not identify exact affected versions, so package and vendor advisory review is required. Treat this as a targeted availability risk for virtualization platforms, especially multi-tenant or delegated-administration environments. It should be remediated through normal security patch cycles unless untrusted guest administrators can impact critical workloads, in which case prioritize faster host updates and exposure review. Mitigation focus: Apply QEMU security updates from the operating system or QEMU vendor channel.; Confirm whether the upstream fix for multiple OHCI eof_timers is included.; Review whether VM configurations require USB OHCI emulation..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.