Important: qemu security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-93834: A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user. CVE-2026-84788: io/channel-socket: do not treat a zero length write as an error CVE-2026-81627: A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory. CVE-2026-77913: hw/display/vga: fix text-mode OOB write after a graphics surface switch CVE-2026-66900: hw/net/virtio-net: strip trailing padding when caching RSC segment CVE-2026-66899: virtio-balloon: fix free-page BH teardown on unrealize CVE-2026-63322: NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3607 NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/4727cc883b7e81d2c30b9801af54482d65b84292 (v11.1.0-rc2) NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/95b9a1bf26fef7c44f4925f78ade7fa824ed5e76 (v11.0.4) CVE-2026-63321: NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/a6e0519ea8ed6fc84fab9bf9ca82c7a55780f880 (v11.1.0-rc2) NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/52c7bb369b23dfcafb6e6d90665c777797b55e88 (v11.1.0-rc2) NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f348425fddae38e0c1d6823501890acfb2a3bfb1 (v11.0.4) NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/9a06bb17256c0a38f0b53025bf804d2e2035f93f (v11.0.4) CVE-2026-63320: Host-side AddressSanitizer heap-buffer-overflow READ in current QEMU master through the virtio-net-pci receive filtering path on q35. The crash is in receive_filter(). CVE-2026-63110: NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/b9d248dfaca5e31377ea4f7204aae788a050bafd (v11.1.0-rc2) NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/82520d7759557062a5fae2211e3c79bbd5f01ed3 (v11.0.4) CVE-2026-61476: NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3875 NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f404bf0e6504e0412a00ea64708f17d2a5e3f869 (v11.1.0-rc2) NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/a4abe1f1fa6f465b64fb400bea14c72bd5e32ac9 (v11.0.4) CVE-2026-61402: NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/733a98a552e4bd68932de1f58bd6ea39b57b261c (v11.1.0-rc2) NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/6680c5612401c1eaa49eba134d14d374fefeb9d4 (v11.0.4) CVE-2026-50624: NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3917 NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/0be94d8d9c28e6b7235b34133d057090fe93be6c (v11.1.0-rc2) NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/88a0e5e45b41d407cf9adf1f2cf6f20f394a578d (v11.0.4) CVE-2026-18054: NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba (v11.1.0-rc3) NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/5fbd2fe1cc54259d045d00d4966aa2db1ba990d6 (v11.0.4) CVE-2026-17588: hw/usb/hcd-xhci: Set reentrancy guard in timer functions