EUVD-2026-48998

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear hyprunningvcpu when flushing the pKVM hyp vCPU flushhypvcpu copies the host vCPU context into the hyp's private vCPU on every run. ctxttovcpu expects a guest context to have a NULL hyprunningvcpu, which is only...

CVE-2026-64285 KVM: SEV: Pin source page for write when adding CPUID data for SNP guest

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guestmemfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the...

CVE-2026-64283

CVE-2026-64283 : In the Linux kernel KVM guest_memfd binding, the offset and size for a memslot were treated inconsistently (signed/unsigned), enabling a potential overflow-related bypass where an extremely large positive offset plus size could be misinterpreted as smaller than the file size. The...

EUVD-2026-48995

In the Linux kernel, the following vulnerability has been resolved: KVM: guestmemfd: Treat memslot binding offset+size as unsigned values When binding a memslot to a guestmemfd file, treat the offset and size as unsigned values to fix a bug where the sum of the two can result in a false negative...

CVE-2026-64283 KVM: guest_memfd: Treat memslot binding offset+size as unsigned values

In the Linux kernel, the following vulnerability has been resolved: KVM: guestmemfd: Treat memslot binding offset+size as unsigned values When binding a memslot to a guestmemfd file, treat the offset and size as unsigned values to fix a bug where the sum of the two can result in a false negative...

CVE-2026-64283

In the Linux kernel, the following vulnerability has been resolved: KVM: guestmemfd: Treat memslot binding offset+size as unsigned values When binding a memslot to a guestmemfd file, treat the offset and size as unsigned values to fix a bug where the sum of the two can result in a false negative...

Linux Distros Unpatched Vulnerability : CVE-2026-64456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwrng: virtio: clamp device-reported used.len at copydata randomrecvdone stores the device-reported used.len directly into vi-dataavail. copydata then indexes...

Linux Distros Unpatched Vulnerability : CVE-2026-64285

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guestmemfd instance with the initial CPUID data for an SNP guest,...

CVE-2026-49744

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes...

CVE-2026-49745

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. The...

CVE-2026-49745 GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. The...

CVE-2026-49745

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. The...

CVE-2026-49745

Technical details (affected product/version, root cause, and fixes) are not publicly available in the provided documents; monitor for updates.

EUVD-2026-48534

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which result in out of bounds memory accesses. The...

CVE-2026-49744

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes...

CVE-2026-49744 GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes...

EUVD-2026-48533

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes...

CVE-2026-49744

CVE-2026-49744 involves kernel software running in a Guest VM that may post commands to the GPU firmware, causing writes outside the Guest’s virtualized GPU memory. The issue stems from out-of-bounds accesses triggered by malware introduced to a Guest KMD, potentially enabling privilege escalatio...

OESA-2026-3101 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: The hardware emulation in the ofdpacmdaddl2flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code ...

SUSE SLES15 Security Update : google-guest-agent (SUSE-SU-2026:3210-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3210-1 advisory. This update for google-guest-agent fixes the following issue - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...