Summary
Dan Smith discovered that Nova incorrectly called qemu-img without a format
restriction when resizing disks. An attacker could possibly use this issue
to destroy data on the host system.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | nova | 3:25.2.1-0ubuntu2.10 |
| Ubuntu · 24.04 LTS 24.04:LTS | nova | 3:29.2.0-0ubuntu1.3 |
| Ubuntu · 25.10 | nova | 3:32.0.0-0ubuntu1.1 |
References
-
report
https://ubuntu.com/security/CVE-2026-24708