Уязвимости qemu

Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob write

A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physical_memory_map() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects, potentially causing information disclosure, data integrity issues, or a denial of service.

• Обновитесь до 1:10.1.0+ds-5ubuntu2.6

UBUNTU-CVE-2026-3886

[virtio-gpu: fix overflow check when allocating 2d image]

UBUNTU-CVE-2026-8343

ui: fix validation of VNC extended clipboard data length

UBUNTU-CVE-2026-6425

libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()

UBUNTU-CVE-2026-48915

hw/uefi: fix parse_hexstr

UBUNTU-CVE-2026-48004

9pfs: fix missing rename lock in v9fs_co_readdir_many

UBUNTU-CVE-2026-48003

ui/vnc: fix OOB read updating VNC update frequency stats

UBUNTU-CVE-2026-48002

ui/vnc OOB writes

Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for cve-2024-7730)

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.

• Обновитесь до 1:10.1.0+ds-5ubuntu2.6

Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation

An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition.

• Обновитесь до 1:10.1.0+ds-5ubuntu2.6

Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.

UBUNTU-CVE-2026-8341

hw/uefi: check auth.hdr_length minimum size

UBUNTU-CVE-2026-41440

hw/uefi: avoid possibly unaligned variable_auth_2 struct field access

UBUNTU-CVE-2026-41439

hw/uefi: verify data size before accessing it in wrap_pkcs7

UBUNTU-CVE-2026-41438

hw/uefi: add name_size check to uefi_vars_mm_lock_variable()

UBUNTU-CVE-2026-41437

hw/uefi: fix ucs2 string helper functions

UBUNTU-CVE-2026-41436

hw/uefi: verify pio_xfer_offset before calculating buffer checksum

UBUNTU-CVE-2026-41435

hw/uefi: fix buffer overruns

UBUNTU-CVE-2026-6502

hw/display: don't accidentally autofree existing virgl resources

UBUNTU-CVE-2026-5763

[virtio-scsi request size mismatch]