PT-2026-71302

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

CVE-2026-16033: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

EUVD-2026-55840

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64t but read by the VMSVBUFFER load path as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to b...

...[ More ]

A proof of concept exploit for a local privilege escalation vulnerability in QEMU Guest Agent version 11.0.3. The vulnerability exists in the guest-ssh-add-authorized-keys handler, where improper handling of symbolic links allows an unprivileged guest user to redirect root-privileged file...

CVE-2026-6426

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64t but read by the VMSVBUFFER load path as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to b...

DEBIAN-CVE-2026-6426

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64t but read by the VMSVBUFFER load path as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to b...

UBUNTU-CVE-2026-6426

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64t but read by the VMSVBUFFER load path as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to b...

CVE-2026-6426

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64t but read by the VMSVBUFFER load path as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to b...

CVE-2026-6426 Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64t but read by the VMSVBUFFER load path as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to b...

CVE-2026-6426

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64t but read by the VMSVBUFFER load path as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to b...

CVE-2026-6426

QEMU's vhost inflight migration VMState handling is affected by a type‑mismatch in the destination buffer size: it is stored as uint64_t but read as signed int32_t. On little‑endian hosts, a crafted incoming migration state with bit 31 set can become negative and be implicitly converted to a very...

CVE-2026-6426 Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64t but read by the VMSVBUFFER load path as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to b...

CVE-2026-6426

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64t but read by the VMSVBUFFER load path as a signed int32t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to b...

CVE-2026-53090 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-qemu-melange, linux-aws, linux-gcp...

GHSA-H443-HX93-M7QC vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-qemu-melange, linux-aws, linux-gcp...

CVE-2026-53078 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-qemu-melange, linux-aws, linux-gcp...

GHSA-PWR6-CVF5-35F3 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-qemu-melange, linux-aws, linux-gcp...

GHSA-QHVV-4MW5-PXH3 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-azure, linux-qemu, linux-aws, linux-gcp...

CVE-2026-63623

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...

DEBIAN-CVE-2026-63623

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents...