Summary
[7.2.0-42.el9]
- migration: Enable multifd VFIO device state transfer by default for Exadata (Maciej S. Szmigiero) [Orabug: 39783645]
- vfio/migration: Add x-migration-load-config-after-iter VFIO property (Maciej S. Szmigiero) [Orabug: 39783615]
- tests/9p: add 3 xattr FID limit test cases (local fs driver) (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- tests/9p: add 3 xattr FID limit test cases (synth fs driver) (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- tests/9p: add virtio_9p_add_synth_driver_args() test client function (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- tests/9p: increase P9_MAX_SIZE for test client (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- hw/9pfs: add xattr count query interface to fs synth driver (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- hw/9pfs: enable xattr (mockup) support for synth fs driver (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- tests/9p: add Txattrcreate / Rxattrcreate test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- tests/9p: add Tclunk / Rclunk test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- tests/9p: add Tread / Rread test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- qemu-options: document 9pfs max_xattr option (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- hw/9pfs: add max_xattr option (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- hw/9pfs: add xattr FID limit to prevent memory exhaustion (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- hw/9pfs: cap Treaddir allocation (CVE-2026-9238) (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- 9pfs/xen: implement response_buffer_size callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- 9pfs/virtio: implement response_buffer_size callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- hw/9pfs: add response_buffer_size transport callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- hw/9pfs: cap negotiated msize to transport limit (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- 9pfs/xen: implement msize_limit callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- 9pfs/virtio: implement msize_limit callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- hw/9pfs: add msize_limit transport callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- 9pfs: fix missing rename lock in v9fs_co_readdir_many (CVE-2026-48004) (sin99xx) [Orabug: 39478419] {CVE-2026-48004}
- tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- libvduse: fix buffer overflow in vduse_queue_read_indirect_desc() (Stefano Garzarella) [Orabug: 39447322] {CVE-2026-6425}
- libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc() (Stefano Garzarella) [Orabug: 39447322] {CVE-2026-6425}
- virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914) (Stefan Hajnoczi) [Orabug: 39522394] {CVE-2026-48914}
[7.2.0-41.el9]
- hw/virtio/virtio-crypto: validate asym session key size (Miguel Luis) [Orabug: 39480090]
- virtio-net: validate RSS queue selectors in parser (Miguel Luis) [Orabug: 39480096]
- ui: fix validation of VNC extended clipboard data length (Heechan Kang) [Orabug: 39442988] {CVE-2026-8343}
- ui/vnc: fix OOB read updating VNC update frequency stats (Daniel P. Berrange) [Orabug: 39447326] {CVE-2026-48003}
- ui/vnc: fix OOB write in lossy rect worker code (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002}
- ui/vnc: fix OOB write in VNC stats array (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002}
- tests/unit/test-blockjob: Disable complete_in_standby test (Peter Maydell) [Orabug: 39447937]
- virtio-scsi: reset SCSI devices from main loop thread (Stefan Hajnoczi) [Orabug: 39296894]
- dma-helpers: prevent dma_blk_cb() vs dma_aio_cancel() race (Stefan Hajnoczi) [Orabug: 39296894]
- scsi: protect req->aiocb with AioContext lock (Stefan Hajnoczi) [Orabug: 39296894]
- virtio-iommu: add error check before assert (Manos Pitsidianakis) [Orabug: 39447244]
- hw/virtio-iommu: Fix potential OOB access in virtio_iommu_handle_command() (Eric Auger) [Orabug: 39447244]
- thread-pool: Allow at least 1 thread in thread_pool_adjust_max_threads_to_work() (Maciej S. Szmigiero) [Orabug: 39429151]
- lsi53c895a: keep a reference to the device while SCRIPTS execute (Paolo Bonzini) [Orabug: 37517793] {CVE-2024-6519}
- hw/scsi/lsi53c895a: fix memory leak in lsi_scsi_realize() (Zheng Huang) [Orabug: 37517793] {CVE-2024-6519}
- hw/scsi/lsi53c895a: bump instruction limit in scripts processing to fix regression (Fiona Ebner) [Orabug: 37517793] {CVE-2024-6519}
- hw/scsi/lsi53c895a: add timer to scripts processing (Sven Schnelle) [Orabug: 37517793] {CVE-2024-6519}
- hw/scsi/lsi53c895a: add missing decrement of reentrancy counter (Sven Schnelle) [Orabug: 39429302]
- hw/i386/amd_iommu: Move IOAPIC memory region initialization to the end (Sairaj Kodilkar) [Orabug: 39422329]
- virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare (Paolo Bonzini) [Orabug: 39414097] {CVE-2026-5763}
- softmmu: Support concurrent bounce buffers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
- system/physmem: Per-AddressSpace bounce buffering (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
- system/physmem: Propagate AddressSpace to MapClient helpers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
- hw/pci: Ignore config-space data between 0x804-0x807 (Joao Martins)
- hostmem-memfd: Documentation for memory-backend-memfd 'keep' property (William Roche) [Orabug: 38769121]
- hostmem-memfd: Wire up MFD_MF_KEEP_UE_MAPPED via 'keep' property (William Roche) [Orabug: 38769121]
[7.2.0-38.el9]
- multifd: Save number of pages for batch context pages (Elena Ufimtseva) [Orabug: 39001115]
- migrati
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | qemu-guest-agent | 31:7.2.0-42.el9 |
| Oracle Linux · 9 | qemu-img | 31:7.2.0-42.el9 |
| Oracle Linux · 9 | qemu-kvm | 31:7.2.0-42.el9 |
| Oracle Linux · 9 | qemu-kvm-block-curl | 31:7.2.0-42.el9 |
| Oracle Linux · 9 | qemu-kvm-block-iscsi | 31:7.2.0-42.el9 |
| Oracle Linux · 9 | qemu-kvm-block-rbd | 31:7.2.0-42.el9 |
| Oracle Linux · 9 | qemu-kvm-block-ssh | 31:7.2.0-42.el9 |
| Oracle Linux · 9 | qemu-kvm-common | 31:7.2.0-42.el9 |
| Oracle Linux · 9 | qemu-kvm-core | 31:7.2.0-42.el9 |
| Oracle Linux · 9 | qemu-kvm-device-usb-host | 31:7.2.0-42.el9 |
| Oracle Linux · 9 | qemu-virtiofsd | 31:7.2.0-42.el9 |
Vulnerabilities 3
-
High 8.2
Qemu: scsi: lsi53c895a: use-after-free local privilege escalation vulnerability
A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.
-
Medium 6.7
Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling
A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed v…
-
Low 3.8
Qemu-kvm: information leak in virtio devices
A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has…