Summary
[10.1.0-17.el9_8.9]
- kvm-qcow2-Add-keep_data_file-command-line-option.patch [RHEL-164549]
- kvm-qcow2-Simplify-size-round-up-in-co_create_opts.patch [RHEL-164549]
- kvm-iotests-common.filter-Sort-keep_data_file.patch [RHEL-164549]
- kvm-iotests-244-Add-test-cases-for-keep_data_file.patch [RHEL-164549]
- kvm-target-i386-mshv-switch-mmio-pagewalk-to-mshv-mmu.patch [RHEL-283121]
- kvm-target-i386-mshv-add-soft-mmu-for-pagewalk.patch [RHEL-283121]
- kvm-pr-manager-helper-fix-sense-buffer-overflow.patch [RHEL-280223]
- kvm-scsi-increase-sense-buffer-size-in-scsi_SG_IO.patch [RHEL-280223]
- kvm-hw-scsi-disk-move-MIG_EVENT_FAILED-into-a-new-functi.patch [RHEL-280223]
- kvm-qemu-pr-helper-add-PR_HELPER_CLEANUP-for-live-migrat.patch [RHEL-280223]
- kvm-pr-manager-helper-add-PR_HELPER_CLEANUP-command-supp.patch [RHEL-280223]
- kvm-file-posix-forward-PR_HELPER_CLEANUP-commands-to-pr-.patch [RHEL-280223]
- kvm-scsi-clean-up-persistent-reservation-state-after-mig.patch [RHEL-280223]
- kvm-scsi-use-REGISTER-AND-IGNORE-EXISTING-KEY-for-robust.patch [RHEL-280223]
- kvm-scsi-document-PR_HELPER_CLEANUP-command.patch [RHEL-280223]
- Resolves: RHEL-164549
(qemu-img can't create a qcow2 overlay with 'data_file' feature on top of a file without destroying the original image [rhel-9.8.z])
- Resolves: RHEL-283121
(Fix pending QEMU issues for L1VH GA - QEMU [rhel-9.8.z])
- Resolves: RHEL-280223
(live migration of a VM with a scsi3pr to a node that previously held a reservation on that disk fails. [rhel-9.8.z])
[10.1.0-17.el9_8.7]
- kvm-qga-Change-effective-user-group-ID-in-guest-ssh-comm.patch [RHEL-212575]
- Resolves: RHEL-212575
(CVE-2026-12080 qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys [rhel-9.8.z])
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | qemu-guest-agent | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-img | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-audio-pa | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-block-blkio | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-block-curl | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-block-rbd | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-common | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-core | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-device-display-virtio-gpu | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-device-display-virtio-gpu-pci | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-device-display-virtio-vga | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-device-usb-host | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-device-usb-redirect | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-docs | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-tools | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-ui-egl-headless | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-kvm-ui-opengl | 17:10.1.0-17.el9_8.9 |
| Oracle Linux · 9 | qemu-pr-helper | 17:10.1.0-17.el9_8.9 |
Vulnerabilities 1
-
High 7.3CVE-2026-12080 Public exploit
Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass o…