qemu vulnerabilities · Page 3

UBUNTU-CVE-2026-15705

usbredir: fix use-after-free on buffered bulk packet overflow

UBUNTU-CVE-2026-15578

QEMU VNC Tight PNG channel-max truncation causes remote denial of service

Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write

A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physical_memory_map() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects, potentially causing information disclosure, data integrity issues, or a denial of service.

• Update to 1:8.2.2+ds-0ubuntu1.16

UBUNTU-CVE-2026-3886

[virtio-gpu: fix overflow check when allocating 2d image]

UBUNTU-CVE-2026-8343

ui: fix validation of VNC extended clipboard data length

UBUNTU-CVE-2026-6425

libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()

UBUNTU-CVE-2026-48004

9pfs: fix missing rename lock in v9fs_co_readdir_many

UBUNTU-CVE-2026-48003

ui/vnc: fix OOB read updating VNC update frequency stats

UBUNTU-CVE-2026-48002

ui/vnc OOB writes

Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for cve-2024-7730)

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.

• Update to 1:8.2.2+ds-0ubuntu1.16

Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation

An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition.

• Update to 1:8.2.2+ds-0ubuntu1.16

Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.

UBUNTU-CVE-2026-5763

[virtio-scsi request size mismatch]

UBUNTU-CVE-2026-5761

[virtio-blk: zone report buffer out-of-memory]

UBUNTU-CVE-2026-3890

[hcd-ohci: infinite loop]

Qemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing

A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensitive information or a denial of service condition (DoS).

• Update to 1:8.2.2+ds-0ubuntu1.16

Qemu-kvm: heap off-by-one in kvm xen physdevop_map_pirq

An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.

• Update to 1:8.2.2+ds-0ubuntu1.13

Qemu-kvm: unbounded allocation in virtio-crypto

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.

• Update to 1:8.2.2+ds-0ubuntu1.13

Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.

• Update to 1:8.2.2+ds-0ubuntu1.13