qemu vulnerabilities · Page 2

UBUNTU-CVE-2026-61405

hw/uefi: account variable policy entries against storage size

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-61404

hw/uefi: add post_load checks

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-61402

libvduse: validate vq size

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-58582

hw/uefi: non-NUL variable policy name causes heap-buffer-overflow in print_policy_entry()

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-58581

hw/uefi: short VarCheckPolicy REGISTER request causes heap-buffer-overflow in uefi-vars

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-50624

hw/virtio-rng: Fix host use-after-free

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-18054

virtio-gpu: reject requests with short/truncated control headers

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-17516

hw/display/vga: text and graphics renderers cache geometry in different units, causing a heap out-of-bounds write in panning_buf

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-16288

SetupMode guest-writable in uefi-vars allows Secure Boot bypass

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-15264

vhost-user-gpu: fix integer overflow in buffer allocation

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-66021

OOB access in virtio-gpu blob resource creation

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-63318

QEMU 9pfs Readonly O_TRUNC/O_APPEND Bypass via 9P2000.u Flag Mismatch

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-50626

virtio: fix queue size validation against allocated maximum

• Update to 1:10.0.13+ds-0+deb13u1

UBUNTU-CVE-2026-16457

virtio: Malformed packed descriptor livelocks the device at 100% host CPU (guest triggered DoS)

• Update to 1:10.0.13+ds-0+deb13u1

Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration c

UBUNTU-CVE-2026-9238

[hw/9pfs: cap Treaddir allocation]

• Update to 1:10.0.12+ds-0+deb13u1

UBUNTU-CVE-2026-8348

[hw/9pfs: add xattr FID limit to prevent memory exhaustion]

• Update to 1:10.0.12+ds-0+deb13u1

UBUNTU-CVE-2026-63319

QEMU USB Redirect Infinite Loop / Divide-by-Zero via max_packet_size=0

• Update to 1:10.0.12+ds-0+deb13u1

UBUNTU-CVE-2026-61475

VNC lossy refresh dirty bitmap OOB write at 2160p

• Update to 1:10.0.12+ds-0+deb13u1

UBUNTU-CVE-2026-16043

QEMU xHCI Interrupter Register OOB Access (Non-Default Configuration)

• Update to 1:10.0.12+ds-0+deb13u1