CVE-2016-7466: Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci...

Security readout for executives and security teams

This is a QEMU virtualization denial-of-service issue. A local administrator inside a guest OS could trigger memory growth in the host QEMU process when xHCI USB with MSI-X is in use, potentially crashing that VM process. The bundle does not provide CVSS, affected versions, or evidence of active exploitation. Exposure is most likely on systems running QEMU with guest-accessible xHCI USB configurations using MSI-X. The provided bundle does not identify exact affected QEMU versions or downstream package ranges, so exposure must be confirmed against vendor advisories and installed packages. Handle as a targeted availability risk, not a broad internet-facing emergency. Prioritize patch verification on multi-tenant or untrusted guest environments because a guest administrator may crash their QEMU process and disrupt workloads. Mitigation focus: Apply QEMU updates from applicable vendor or distribution advisory channels.; Confirm deployed QEMU includes upstream fix commit b53dd4495ced2432a0b652ea895e651d07336f7e.; For unsupported builds, check QEMU or OS vendor guidance before relying on local patches..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.