Summary
[7.2.0-37.el9]
- hashing: use mmap/munmap for isal functions (Elena Ufimtseva) [Orabug: 39165991]
- multifd: replace allocations/free with mmap/munmap (Elena Ufimtseva) [Orabug: 39165991]
- page_cache: use mmap() based data pool for cache items (Elena Ufimtseva) [Orabug: 39165991]
- page_cache: change cache allocations to mmap (Elena Ufimtseva) [Orabug: 39165991]
- migration: add mmap/munmap wrapper (Elena Ufimtseva) [Orabug: 39165991]
- target/i386/kvm: Use zero if kvm_msr_entry_add() is called by getter (Dongli Zhang) [Orabug: 38965920]
- target/i386/kvm: Use logical counter index for AMD PMU getter (Dongli Zhang) [Orabug: 38965920]
- Document CVEs (Mark Kanda) {CVE-2025-54566} {CVE-2025-54567} {CVE-2025-8860} {CVE-2026-0665} {CVE-2026-3886}
- hw/usb/hcd-ohci: check for MPS=0 to avoid infinite loop (Jenny Guanni Qu) [Orabug: 39160764] {CVE-2026-3890}
- hyperv/syndbg: check length returned by cpu_physical_memory_map() (Paolo Bonzini) [Orabug: 39160749] {CVE-2026-3842}
- block/vmdk: fix OOB read in vmdk_read_extent() (Halil Oktay) [Orabug: 39160776] {CVE-2026-2243}
- cryptodev-builtin: Limit the maximum size (zhenwei pi) [Orabug: 39173335] {CVE-2025-14876}
- hw/virtio/virtio-crypto: verify asym request size (zhenwei pi) [Orabug: 39173335] {CVE-2025-14876}
[7.2.0-36.el9]
- migration: Fix missing Error return in .load_setup() handlers (Maciej S. Szmigiero) [Orabug: 39154816]
- migration: Fix missing Error return in .save_setup() handlers (Maciej S. Szmigiero) [Orabug: 39154816]
- migration: qemu_savevm_state_setup(): Fix double PRECOPY_NOTIFY_SETUP call (Maciej S. Szmigiero) [Orabug: 39154816]
- multifd: Fix device state transfer (Maciej S. Szmigiero) [Orabug: 39154816]
- vfio/migration: Send VFIO_MIGRATION event before PRE_COPY_P2P transition (Avihai Horon) [Orabug: 39122260]
- vfio/migration: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39121536]
[7.2.0-35.el9]
- migration: Disable switchover-ack-legacy by default for Exadata (Maciej S. Szmigiero) [Orabug: 37502472]
- vfio/migration: Check VFIO_PRECOPY_INFO_REINIT during completion (Avihai Horon) [Orabug: 37502472]
- vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT (Avihai Horon) [Orabug: 37502472]
- vfio/migration: Implement new switchover-ack mechanism (Avihai Horon) [Orabug: 37502472]
- vfio/migration: Add Error ** parameter to vfio_migration_init() (Avihai Horon) [Orabug: 37502472]
- vfio/migration: Re-query precopy size before sending VFIO_MIG_FLAG_DEV_INIT_DATA_SENT (Avihai Horon) [Orabug: 37502472]
- migration: Check switchover-ack during switchover phase (Avihai Horon) [Orabug: 37502472]
- migration: Make switchover-ack re-usable (Avihai Horon) [Orabug: 37502472]
- migration: Refactor switchover-ack code (Avihai Horon) [Orabug: 37502472]
- linux-headers: Bring initial bytes re-init uAPI (Avihai Horon) [Orabug: 37502472]
- qemu-img: convert: add cli argument to use IO large buffers for convert (Akash Kulhalli) [Orabug: 37502472]
- hw/core/machine: Limit x-orcl-vm-tsc-khz-post-loadvm to KVM (Mark Kanda) [Orabug: 39095032]
- migration: add extra check for block in cache_fini (Elena Ufimtseva) [Orabug: 38885625]
- migration: do not tear down hash cache in critical path (Elena Ufimtseva) [Orabug: 38885625]
- migration: free cache->blocks in cache_fini() (Elena Ufimtseva) [Orabug: 39061395]
[7.2.0-34.el9]
- migration: bugfix - free migration_ops correctly (Elena Ufimtseva) [Orabug: 38977316]
- target/i386/kvm: set VM ioctl KVM_SET_TSC_KHZ post loadvm (Dongli Zhang) [Orabug: 38928409]
- migration: introduce KVM function called post loadvm (Dongli Zhang) [Orabug: 38928409]
- migration: add extra checks in multifd_ram_fill_packet (Elena Ufimtseva) [Orabug: 38949741]
- migration: fix the error path semantic in multifd thread (Elena Ufimtseva) [Orabug: 38949741]
- page_cache: dynamic cache allocation (Elena Ufimtseva) [Orabug: 38854239] [Orabug: 38949741]
- multifd: return errors on packets filling (Elena Ufimtseva) [Orabug: 38854239]
- migration: detect errors on hash initialization (Elena Ufimtseva) [Orabug: 38876780]
- migration: propagate hashing errors (Elena Ufimtseva) [Orabug: 38876780]
- migration/multifd: Handle allocation failures (Elena Ufimtseva) [Orabug: 38876780]
- migration: Add Error** argument to ram_state_init() (Cedric Le Goater) [Orabug: 38876780]
- migration: Add Error** argument to .load_setup() handler (Cedric Le Goater) [Orabug: 38876780]
- migration: Add Error** argument to .save_setup() handler (Cedric Le Goater) [Orabug: 38876780]
- migration: Add Error** argument to qemu_savevm_state_setup() (Cedric Le Goater) [Orabug: 38876780]
- migration: Add Error** argument to vmstate_save() (Cedric Le Goater) [Orabug: 38876780]
- migration: Always report an error in ram_save_setup() (Cedric Le Goater) [Orabug: 38876780]
- qemu-file: Make qemu_fflush() return errors (Juan Quintela) [Orabug: 38876780]
- qemu-file: remove shutdown member (Juan Quintela) [Orabug: 38876780]
- vfio: Always report an error in vfio_save_setup() (Cedric Le Goater) [Orabug: 38876780]
- migration/vmstate: Introduce vmstate_save_state_with_err (Tejus GK) [Orabug: 38876780]
- migration/vfio: Remove x-orcl-device-dirty-page-tracking (Elena Ufimtseva) [Orabug: 38944077]
- target/i386/kvm: write tsc_offset for parked vCPUs too (Dongli Zhang) [Orabug: 38853905]
- accel/kvm:: move KVMParkedVcpu definition to header file (Dongli Zhang) [Orabug: 38853905]
- target/i386/kvm: use vCPU 0 tsc_offset for all vCPUs (Dongli Zhang) [Orabug: 38853905]
- target/i386/kvm: account downtime only with synchronized TSC (Dongli Zhang) [Orabug: 38853905]
- target/i386/kvm: implement reset method for kvmclock (Dongli Zhang) [Orabug: 38853905]
[7.2.0-33.el9]
- migration: Change default pages to scan to 8192 for Exadata (Elena Ufimtseva) [Orabug: 38732433]
- meson: check if isa-l installed and enable it (Elena Ufimtseva) [Orabug: 38732433]
- migration/page_cache: Improve isal-crypto-mb-sha256 cache-miss handling (Joao Martins) [Orabug:
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | qemu-guest-agent | 31:7.2.0-37.el9 |
| Oracle Linux · 9 | qemu-img | 31:7.2.0-37.el9 |
| Oracle Linux · 9 | qemu-kvm | 31:7.2.0-37.el9 |
| Oracle Linux · 9 | qemu-kvm-block-curl | 31:7.2.0-37.el9 |
| Oracle Linux · 9 | qemu-kvm-block-iscsi | 31:7.2.0-37.el9 |
| Oracle Linux · 9 | qemu-kvm-block-rbd | 31:7.2.0-37.el9 |
| Oracle Linux · 9 | qemu-kvm-block-ssh | 31:7.2.0-37.el9 |
| Oracle Linux · 9 | qemu-kvm-common | 31:7.2.0-37.el9 |
| Oracle Linux · 9 | qemu-kvm-core | 31:7.2.0-37.el9 |
| Oracle Linux · 9 | qemu-kvm-device-usb-host | 31:7.2.0-37.el9 |
| Oracle Linux · 9 | qemu-virtiofsd | 31:7.2.0-37.el9 |
Vulnerabilities 10
-
High 7.5
Qemu-kvm: vnc websocket handshake use-after-free
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by…
-
Medium 6.5
Qemu-kvm: heap off-by-one in kvm xen physdevop_map_pirq
An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memor…
-
Medium 5.6
A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, po…
-
Medium 5.6
A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potent…
-
Medium 5.5
Qemu-kvm: usb: assertion failure in usb_ep_get()
A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and c…
-
Medium 5.5
Qemu-kvm: unbounded allocation in virtio-crypto
A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by cau…
-
Medium 5.1
Qemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing
A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensitive information or a denial of service condition (DoS).
-
Medium 4.2
hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327.
-
Medium 4.2
hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327.
-
Low 3.3
Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback
A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled…