Rocky Linux 10.2 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc (crlsa-2026_58571)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202658571 advisory. qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling CVE-2026-48914 Bug Fixes and Enhancements: qemu-kvm hung during drain after double pause...

Rocky Linux 9 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc (crlsa-2026_39311)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639311 advisory. qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling CVE-2026-48914 Tenable has extracted the preceding description block directly from the CIQ...

PT-2026-93490

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qla2xxx driver where the qla2x00 status entry function fails to properly validate SCSI Request Blocks SRB before they enter the SCSI fast path. The function filter...

EulerOS Virtualization 2.13.1 : qemu (EulerOS-SA-2026-3205)

According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input...

qemu-kvm security, bug fix, and enhancement update

An update is available for qemu-kvm. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Kernel-based Virtual Machine KVM is a full virtualization solution for Linu...

qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an...

Moderate: Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update

An update for qemu-kvm is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

qemu-kvm security, bug fix, and enhancement update

10.1.0-16.el102.5 - kvm-file-posix-populate-pwritezeroesalignment.patch RHEL-207389 - kvm-block-use-pwritezeroesalignment-when-writing-first.patch RHEL-207389 - kvm-iotests-add-Linux-loop-device-image-creation-test.patch RHEL-207389 - Resolves: RHEL-207389 qemu-img create/convert fails on target...

ALSA-2026:58571 Moderate: qemu-kvm security, bug fix, and enhancement update

Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fixes: qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling...

Oracle Linux 10 : qemu-kvm (ELSA-2026-58571)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-58571 advisory. 10.1.0-16.el102.5 - kvm-file-posix-populate-pwritezeroesalignment.patch RHEL-207389 - kvm-block-use-pwritezeroesalignment-when-writing-first.patch RHEL-207389...

RHEL 10 : qemu-kvm (RHSA-2026:58571)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:58571 advisory. Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the...

RockyLinux 10 : qemu-kvm (RLSA-2026:58571)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58571 advisory. qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling CVE-2026-48914 Bug Fixes and Enhancements: qemu-kvm hung during drain after double pause...

MiracleLinux 9 : qemu-kvm-10.1.0-17.el9_8.4.ML.1 (AXSA:2026-1505:04)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1505:04 advisory. qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling CVE-2026-48914 Tenable has extracted the preceding description block directly from the...

RLSA-2026:39311 Low: qemu-kvm security update

Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fixes: qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling...

SUSE CVE-2026-48914

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an...

AZL-90138 CVE-2026-48914 affecting package qemu for versions less than 9.1.0-8

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an...

CVE-2026-48914

A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an...

CVE-2026-48914

CVE-2026-48914 affects QEMU’s virtio-blk device. The issue: the driver does not validate input descriptor sizes when handling virtio-blk SCSI requests, allowing a malicious guest with high privileges to trigger an out-of-bounds write in host heap memory, causing potential DoS of the QEMU process....

CVE-2025-68818

In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" This reverts commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9. The commit being reverted added code to qla2x00abortallcmds to call sp-done without...

CVE-2025-68288 usb: storage: Fix memory leak in USB bulk transport

In the Linux kernel, the following vulnerability has been resolved: usb: storage: Fix memory leak in USB bulk transport A kernel memory leak was identified by the 'ioctlsg01' test from Linux Test Project LTP. The following bytes were mainly observed: 0x53425355. When USB storage devices incorrect...