UBUNTU-CVE-2026-16457
virtio: Malformed packed descriptor livelocks the device at 100% host CPU (guest triggered DoS)
- Mettez à jour vers 1:11.1.0+ds-1
Publication Mise à jour
PatchFirst · Vulnérabilités récentes
Vulnérabilités de qemu · Page n° 3
Vulnérabilités publiées pour qemu au cours des 30 derniers jours : 14. Présentes dans le catalogue KEV : 0.
Vulnérabilités : 507
Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration c
- Mettez à jour vers 1:11.1.2+ds-2
Publication Mise à jourUBUNTU-CVE-2026-9238
[hw/9pfs: cap Treaddir allocation]
- Mettez à jour vers 1:11.0.3+ds-1
Publication Mise à jourUBUNTU-CVE-2026-8348
[hw/9pfs: add xattr FID limit to prevent memory exhaustion]
- Mettez à jour vers 1:11.0.3+ds-1
Publication Mise à jourUBUNTU-CVE-2026-63319
QEMU USB Redirect Infinite Loop / Divide-by-Zero via max_packet_size=0
- Mettez à jour vers 1:11.0.3+ds-1
Publication Mise à jourUBUNTU-CVE-2026-61475
VNC lossy refresh dirty bitmap OOB write at 2160p
- Mettez à jour vers 1:11.0.3+ds-1
Publication Mise à jourUBUNTU-CVE-2026-16043
QEMU xHCI Interrupter Register OOB Access (Non-Default Configuration)
- Mettez à jour vers 1:11.0.3+ds-1
Publication Mise à jourUBUNTU-CVE-2026-15705
usbredir: fix use-after-free on buffered bulk packet overflow
- Mettez à jour vers 1:11.0.3+ds-1
Publication Mise à jourUBUNTU-CVE-2026-15578
QEMU VNC Tight PNG channel-max truncation causes remote denial of service
- Mettez à jour vers 1:11.0.3+ds-1
Publication Mise à jourQemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.
- Mettez à jour vers 1:11.1.2+ds-1
Publication Mise à jourQemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write
A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physical_memory_map() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects, potentially causing information disclosure, data integrity issues, or a denial of service.
- Mettez à jour vers 1:10.2.2+ds-1
Publication Mise à jourUBUNTU-CVE-2026-3886
[virtio-gpu: fix overflow check when allocating 2d image]
- Mettez à jour vers 1:11.0.0+ds-1
Publication Mise à jourUBUNTU-CVE-2026-8343
ui: fix validation of VNC extended clipboard data length
- Mettez à jour vers 1:11.0.2+ds-1
Publication Mise à jourUBUNTU-CVE-2026-6425
libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()
- Mettez à jour vers 1:11.0.2+ds-1
Publication Mise à jourUBUNTU-CVE-2026-48915
hw/uefi: fix parse_hexstr
- Mettez à jour vers 1:11.0.2+ds-1
Publication Mise à jourUBUNTU-CVE-2026-48004
9pfs: fix missing rename lock in v9fs_co_readdir_many
- Mettez à jour vers 1:11.0.2+ds-1
Publication Mise à jourUBUNTU-CVE-2026-48003
ui/vnc: fix OOB read updating VNC update frequency stats
- Mettez à jour vers 1:11.0.2+ds-1
Publication Mise à jourUBUNTU-CVE-2026-48002
ui/vnc OOB writes
- Mettez à jour vers 1:11.0.3+ds-1
Publication Mise à jourQemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for cve-2024-7730)
A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.
- Mettez à jour vers 1:10.2.2+ds-1
Publication Mise à jourQemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation
An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition.
- Mettez à jour vers 1:10.2.2+ds-1
Publication Mise à jour
Vérifiez votre serveur
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.