Description
A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | qemu | 1.1.0 – ≤ 11.0.1 | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux for NVIDIA 26 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:11.0.2+ds-1 | — |
| Debian 13 | qemu | 1:10.0.11+ds-0+deb13u1 | — |
| Debian 12 | qemu | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | qemu +1 | No fix yet | — |
| Ubuntu 26.04 LTS | qemu +1 | No fix yet | — |
| Ubuntu 25.10 | qemu | No fix yet | — |
| Ubuntu 24.04 LTS | qemu | No fix yet | — |
| Ubuntu 22.04 LTS | qemu | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | qemu | No fix yet | — |
| Ubuntu Pro 18.04 LTS | qemu | No fix yet | — |
| Ubuntu Pro 16.04 LTS | qemu | No fix yet | — |
| Ubuntu Pro 14.04 LTS | qemu | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | qemu-img +19 | 18:10.1.0-16.el10_2.5 | RHSA-2026:58571 |
| RHEL 9 | qemu-img +19 | 17:10.1.0-17.el9_8.4 | RHSA-2026:39311 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | qemu-img +19 | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux 9 | qemu-img +19 | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | qemu-kvm | 8:10.1.0-16.el10_2.5 | RLSA-2026:58571 |
| Rocky Linux 9 | qemu-kvm | 7:10.1.0-17.el9_8.4 | RLSA-2026:39311 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | qemu +1 | 9.2.4-150700.3.23.1 | SUSE-SU-2026:3038-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | qemu +1 | 10.0.11-160000.1.1 | SUSE-SU-2026:22576-1 |
| SLES 16.0 | qemu +1 | 10.0.11-160000.1.1 | SUSE-SU-2026:22576-1 |
| SLE Micro 6.2 | qemu | 10.0.11-160000.1.1 | SUSE-SU-2026:22550-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | qemu | 11.0.2-1.1 | openSUSE-SU-2026:11250-1 |
| openSUSE Leap 16.0 | qemu +1 | 10.0.11-160000.1.1 | openSUSE-SU-2026:21253-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qemu +26 | 10:3.1.0-8.amzn2.0.25 | ALAS2-2026-3793 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | qemu | 9.1.0-8 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | qemu-img +18 | 18:10.1.0-16.el10_2.5 | ELSA-2026-58571 |
| Oracle Linux 9 | qemu-img +18 | 17:10.1.0-17.el9_8.4 | ELSA-2026-500220, ELSA-2026-39311 |
| Oracle Linux 9 | qemu-virtiofsd +2 | 31:7.2.0-42.el9 | ELSA-2026-500220 |
Advisories 16
- ALSA-2026:39311 Low: qemu-kvm security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:58571 Moderate: qemu-kvm security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-1908 QEMU: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 9, 2026
- RHSA-2026:58571 Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RHSA-2026:39311 Red Hat Security Advisory: qemu-kvm security update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RLSA-2026:58571 Moderate: qemu-kvm security, bug fix, and enhancement update Rocky Linux Security Advisories · Aug 24, 2026
- ELSA-2026-58571 Moderate: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 24, 2026
- ELSA-2026-500220 Moderate: qemu-kvm security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 19, 2026
- SUSE-SU-2026:3038-1 Security update for qemu SUSE / openSUSE Security Updates · Jul 16, 2026
- SUSE-SU-2026:22576-1 Security update for qemu SUSE / openSUSE Security Updates · Jul 15, 2026
- RLSA-2026:39311 Low: qemu-kvm security update Rocky Linux Security Advisories · Jul 15, 2026
- SUSE-SU-2026:22550-1 Security update for qemu SUSE / openSUSE Security Updates · Jul 14, 2026
- ELSA-2026-39311 Low: qemu-kvm security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 14, 2026
- openSUSE-SU-2026:11250-1 qemu-11.0.2-1.1 on GA media SUSE / openSUSE Security Updates · Jul 11, 2026
- openSUSE-SU-2026:21253-1 Security update for qemu SUSE / openSUSE Security Updates · Jul 9, 2026
- ALAS2-2026-3793 Moderate: qemu security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 7, 2026
References
- RHSA-2026:39311 vendor-advisory
- RHSA-2026:58571 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-48914 vdb-entry
- RHBZ#2488283 issue-tracking
- https://lore.kernel.org/qemu-devel/20260526154957.1741622-1-stefanha@redhat.com/