UBUNTU-CVE-2026-16457
virtio: Malformed packed descriptor livelocks the device at 100% host CPU (guest triggered DoS)
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости qemu · Страница 3
За последние 30 дней в qemu опубликовано уязвимостей: 14; в каталоге KEV: 0.
Уязвимостей: 485
Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration c
Опубликовано ОбновленоUBUNTU-CVE-2026-9238
[hw/9pfs: cap Treaddir allocation]
Опубликовано ОбновленоUBUNTU-CVE-2026-8348
[hw/9pfs: add xattr FID limit to prevent memory exhaustion]
Опубликовано ОбновленоUBUNTU-CVE-2026-63319
QEMU USB Redirect Infinite Loop / Divide-by-Zero via max_packet_size=0
Опубликовано ОбновленоUBUNTU-CVE-2026-61475
VNC lossy refresh dirty bitmap OOB write at 2160p
Опубликовано ОбновленоUBUNTU-CVE-2026-16043
QEMU xHCI Interrupter Register OOB Access (Non-Default Configuration)
Опубликовано ОбновленоUBUNTU-CVE-2026-15705
usbredir: fix use-after-free on buffered bulk packet overflow
Опубликовано ОбновленоUBUNTU-CVE-2026-15578
QEMU VNC Tight PNG channel-max truncation causes remote denial of service
Опубликовано ОбновленоQemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.
Опубликовано ОбновленоQemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write
A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physical_memory_map() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects, potentially causing information disclosure, data integrity issues, or a denial of service.
Опубликовано ОбновленоUBUNTU-CVE-2026-8343
ui: fix validation of VNC extended clipboard data length
Опубликовано ОбновленоUBUNTU-CVE-2026-6425
libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()
Опубликовано ОбновленоUBUNTU-CVE-2026-48004
9pfs: fix missing rename lock in v9fs_co_readdir_many
Опубликовано ОбновленоUBUNTU-CVE-2026-48003
ui/vnc: fix OOB read updating VNC update frequency stats
Опубликовано ОбновленоUBUNTU-CVE-2026-48002
ui/vnc OOB writes
Опубликовано ОбновленоQemu-kvm: heap buffer overflow in virtio-blk scsi request handling
A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.
Опубликовано ОбновленоUBUNTU-CVE-2026-5763
[virtio-scsi request size mismatch]
Опубликовано ОбновленоUBUNTU-CVE-2026-3890
[hcd-ohci: infinite loop]
Опубликовано ОбновленоQemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing
A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensitive information or a denial of service condition (DoS).
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.