UBUNTU-CVE-2026-61405
hw/uefi: account variable policy entries against storage size
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости qemu-hwe · Страница 2
За последние 30 дней в qemu-hwe опубликовано уязвимостей: 7; в каталоге KEV: 0.
Уязвимостей: 79
UBUNTU-CVE-2026-61404
hw/uefi: add post_load checks
Опубликовано ОбновленоUBUNTU-CVE-2026-61402
libvduse: validate vq size
Опубликовано ОбновленоUBUNTU-CVE-2026-58582
hw/uefi: non-NUL variable policy name causes heap-buffer-overflow in print_policy_entry()
Опубликовано ОбновленоUBUNTU-CVE-2026-58581
hw/uefi: short VarCheckPolicy REGISTER request causes heap-buffer-overflow in uefi-vars
Опубликовано ОбновленоUBUNTU-CVE-2026-50624
hw/virtio-rng: Fix host use-after-free
Опубликовано ОбновленоUBUNTU-CVE-2026-18054
virtio-gpu: reject requests with short/truncated control headers
Опубликовано ОбновленоUBUNTU-CVE-2026-17516
hw/display/vga: text and graphics renderers cache geometry in different units, causing a heap out-of-bounds write in panning_buf
Опубликовано ОбновленоUBUNTU-CVE-2026-16288
SetupMode guest-writable in uefi-vars allows Secure Boot bypass
Опубликовано ОбновленоUBUNTU-CVE-2026-15264
vhost-user-gpu: fix integer overflow in buffer allocation
Опубликовано ОбновленоUBUNTU-CVE-2026-66021
OOB access in virtio-gpu blob resource creation
Опубликовано ОбновленоUBUNTU-CVE-2026-63318
QEMU 9pfs Readonly O_TRUNC/O_APPEND Bypass via 9P2000.u Flag Mismatch
Опубликовано ОбновленоUBUNTU-CVE-2026-50626
virtio: fix queue size validation against allocated maximum
Опубликовано ОбновленоUBUNTU-CVE-2026-16457
virtio: Malformed packed descriptor livelocks the device at 100% host CPU (guest triggered DoS)
Опубликовано ОбновленоQemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration c
Опубликовано ОбновленоUBUNTU-CVE-2026-9238
[hw/9pfs: cap Treaddir allocation]
Опубликовано ОбновленоUBUNTU-CVE-2026-8348
[hw/9pfs: add xattr FID limit to prevent memory exhaustion]
Опубликовано ОбновленоUBUNTU-CVE-2026-63319
QEMU USB Redirect Infinite Loop / Divide-by-Zero via max_packet_size=0
Опубликовано ОбновленоUBUNTU-CVE-2026-61475
VNC lossy refresh dirty bitmap OOB write at 2160p
Опубликовано ОбновленоUBUNTU-CVE-2026-16043
QEMU xHCI Interrupter Register OOB Access (Non-Default Configuration)
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.