Description
The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:2.6+dfsg-3.1 | — |
| Debian 13 | qemu | 1:2.6+dfsg-3.1 | — |
| Debian 12 | qemu | 1:2.6+dfsg-3.1 | — |
| Debian 8 | qemu | 1:2.1+dfsg-12+deb8u8 | DLA-1599-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | qemu | 1:2.5+dfsg-5ubuntu10.6 | USN-3125-1 |
| Ubuntu 14.04 LTS | qemu | 2.0.0+dfsg-2ubuntu1.30 | USN-3125-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | qemu | 2.3.1-21.1 | SUSE-SU-2016:2589-1 |
| SLES 12 | qemu | 2.0.2-48.22.1 | SUSE-SU-2016:2781-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | qemu | 2.3.1-21.1 | SUSE-SU-2016:2589-1 |
| SLES for SAP 12 | qemu | 2.0.2-48.22.1 | SUSE-SU-2016:2781-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | qemu | 6.1.0-32.1 | openSUSE-SU-2024:11287-1 |
Advisories 5
- DLA-1599-1 qemu - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3125-1 qemu, qemu-kvm vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2016:2781-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:2589-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11287-1 qemu-6.1.0-32.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- [qemu-devel] 20160906 [PATCH v3] scsi: pvscsi: avoid infinite loop while building SG list mailing-list
- [oss-security] 20160906 CVE request: Qemu: scsi: pvscsi: infintie loop when building SG list mailing-list
- [qemu-devel] 20160906 [PATCH v2] scsi: pvscsi: check request descriptor SG element count mailing-list
- [oss-security] 20160906 Re: CVE request: Qemu: scsi: pvscsi: infintie loop when building SG list mailing-list
- GLSA-201609-01 vendor-advisory
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=49adc5d3f8c6bb75e55ebfeab109c5c37dea65e8
- [debian-lts-announce] 20181130 [SECURITY] [DLA 1599-1] qemu security update mailing-list
- 92774 vdb-entry