qemu-kvm security and bug fix update

7.2.0-14.el92.5 - rhel guest failed boot with multi disks on error Failed to start udev Wait for Complete Device Initialization - CVE-2023-3354 QEMU: VNC: improper I/O watch removal in TLS handshake can lead to remote unauthenticated denial of service - hotplug/hotunplug mlx vdpa device to the...

ALSA-2023:5094 Important: qemu-kvm security and bug fix update

Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fixes: QEMU: VNC: improper I/O watch removal in TLS handshake can lead to remote...

PT-2025-40195

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s IB/hfi1 component that could lead to a system panic during hotplug removal. Specifically, update counters work might still be pending and execute afte...

kernel: scsi: qla2xxx: Fix crash when I/O abort times out

A flaw was found in the Linux kernel's qla2xxx driver. When an input/output I/O abort request times out, the driver attempts to process completion without verifying whether the request has already finished. A local user could trigger these conditions during system operations such as dynamic...

kernel: scsi: qla2xxx: Fix crash when I/O abort times out

A flaw was found in the Linux kernel's qla2xxx driver. When an input/output I/O abort request times out, the driver attempts to process completion without verifying whether the request has already finished. A local user could trigger these conditions during system operations such as dynamic...

kernel: powerpc/memhotplug: Add add_pages override for PPC

In the Linux kernel, the following vulnerability has been resolved: powerpc/memhotplug: Add addpages override for PPC With commit ffa0b64e3be5 "powerpc: Fix virtaddrvalid for 64-bit Book3E & 32-bit" the kernel now validate the addr against highmemory value. This results in the below BUGON with da...

org.nutz:nutz-plugins-hotplug (1.r.67), org.nutz:nutz-plugins-ngrok (1.r.67) +3 more potentially affected by CVE-2023-30331 via com.ibeetl:beetl (2.8.7)

com.ibeetl:beetl MAVEN version 2.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.ibeetl:beetl and may be impacted: - org.nutz:nutz-plugins-hotplug 1.r.67 - org.nutz:nutz-plugins-ngrok 1.r.67 - org.nutz:nutz-plugins-views 1.r.67 -...

com.jflyfox:jflyfox_jfinal (4.2), org.nutz:nutz-plugins-hotplug (>=1.r.60.r3, <=1.r.65) potentially affected by CVE-2023-30331 via com.ibeetl:beetl (2.7.5)

com.ibeetl:beetl MAVEN version 2.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.ibeetl:beetl and may be impacted: - com.jflyfox:jflyfoxjfinal 4.2 - org.nutz:nutz-plugins-hotplug =1.r.60.r3, =1.r.65 Source cves: CVE-2023-30331 Source advisory:...

PT-2025-40229

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a circular locking dependency between cpu hotplug lock and freezer mutex within the cgroup freezer subsystem. Specifically, the issue arises from the order in...

PT-2025-18887

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free vulnerability has been identified in the Linux kernel related to PCI resources with per-function hotplug on s390 systems. This issue arises when PCI functions are...

K52401347: Linux kernel vulnerability CVE-2021-28972

Security Advisory Description In drivers/pci/hotplug/rpadlparsysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly...

SUSE CVE-2012-2121

The KVM implementation in the Linux kernel before 3.3.4 does not properly manage the relationships between memory slots and the iommu, which allows guest OS users to cause a denial of service memory leak and host OS crash by leveraging administrative access to the guest OS to conduct hotunplug an...

SUSE CVE-2012-5517

The onlinepages function in mm/memoryhotplug.c in the Linux kernel before 3.6 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact in opportunistic circumstances by using memory that was hot-added by an administrator...

SUSE CVE-2014-3471

Use-after-free vulnerability in hw/pci/pcie.c in QEMU aka Quick Emulator allows local guest OS users to cause a denial of service QEMU instance crash via hotplug and hotunplug operations of Virtio block devices...

SUSE CVE-2014-5388

Off-by-one error in the pciread function in the ACPI PCI hotplug interface hw/acpi/pcihp.c in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption...

SUSE CVE-2016-9923

Quick Emulator Qemu built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS...

SUSE CVE-2017-15594

An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service hypervisor crash or gain privileges because IDT settings are mishandled during CPU hotplugging...

SUSE CVE-2019-19067

Four memory leaks in the acphwinit function in drivers/gpu/drm/amd/amdgpu/amdgpuacp.c in the Linux kernel before 5.3.8 allow attackers to cause a denial of service memory consumption by triggering mfdaddhotplugdevices or pmgenpdadddevice failures, aka CID-57be09c6e874. NOTE: third parties dispute...

SUSE CVE-2021-28039

An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom0 or driver domain via a large amount of I/O activity. The issue relates to misuse of guest physical addresses when a configuration has...

SUSE CVE-2021-28972

In drivers/pci/hotplug/rpadlparsysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because...