CVE-2026-10047: Out-of-bounds Write

The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.c. The handler uses a guest-controlled SS:SP-derived offset as an index into the 1MB RealModeMemory buffer without bounds validation. With...

Bitdefender Napoca 缓冲区错误漏洞

Bitdefender Napoca is a lightweight Type-1 bare-machine virtual machine monitor developed by Bitdefender as open source. Bitdefender Napoca has a buffer error vulnerability, which stems from an out-of-bounds write in the BIOS INT 0x15/E820 memory mapping processing routine. This vulnerability cou...

PT-2026-45767

Name of the Vulnerable Software and Affected Versions Bitdefender Napoca affected versions not specified Description An out-of-bounds write exists in the real-mode hook handler within the napoca/kernel/handler.c file. The handler utilizes a guest-controlled offset derived from SS:SP as an index...

CVE-2026-10046: Out-of-bounds Write

Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bioshandlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI...

Bitdefender Napoca 缓冲区错误漏洞

Bitdefender Napoca is a lightweight Type-1 bare-machine virtual machine monitor developed by Bitdefender as open source. Bitdefender Napoca has a buffer error vulnerability, which stems from out-of-bounds write operations in the real-mode hook processing routine. This vulnerability may lead to IR...

PT-2026-45205

Name of the Vulnerable Software and Affected Versions Cloud Hypervisor versions 21.0 through 51.1 Description A guest can cause a use-after-free in the cloud-hypervisor process by submitting two virtio-block descriptor chains that reuse the same head index while asynchronous block I/O such as io...

OPENSUSE-SU-2026:10907-1 cloud-hypervisor-52.0-1.1 on GA media

These are all security issues fixed in the cloud-hypervisor-52.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-46147

CVE-2026-46147 concerns the Linux kernel KVM on ARM64, where two bugs in vCPU initialisation can leak pin references to host vCPU/SVE pages and allow observation of a partially initialised vCPU object. The fixes extract a helper for vCPU registration, ensure proper unpinning on error, and enforce...

EUVD-2026-32774

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix pin leak and publication ordering in pkvminitvcpu Two bugs exist in the vCPU initialisation path: 1. If a check fails after hyppinsharedmem succeeds, the cleanup path jumps to 'unlock' without calling unpinhostvcp...

SUSE CVE-2026-46076

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Raise UD if unhandled VMMCALL isn't intercepted by L1 Explicitly synthesize a UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nestedsvml2tlbflushenabled is true, and the hypercall is something...

[SECURITY] Fedora 44 Update: xen-4.21.1-3.fc44

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

[SECURITY] Fedora 43 Update: xen-4.20.3-3.fc43

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

CVE-2026-46076

The CVE-2026-46076 entry concerns the Linux kernel KVM nSVM, where an unhandled VMMCALL can produce an Undefined Opcode (#UD) when L2 is active, L1 does not intercept, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is not among the supported Hyper-V hypercalls. The vulnerability ari...

Linux Distros Unpatched Vulnerability : CVE-2026-46076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: nSVM: Raise UD if unhandled VMMCALL isn't intercepted by L1 Explicitly synthesize a UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL,...

Ubuntu 24.04 LTS : Linux kernel (FIPS) vulnerabilities (USN-8296-1)

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8296-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Initialize Xen timers only once A check for existing xen timers was added before initializing a new timer. Currently, the kvmxeninittimer function is called every time KVMXENVCPUATTRTYPETIMER is used. This causes th...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve a full Gunyah metadata region. We have observed spurious “Synchronous External Abort” exceptions ESR=0x96000010 and kernel crashes on Monaco-based platforms. These faults are caused by the kernel...

Vulnerability of function system_domains.ml:30-35() in the RBAC access role management subsystem of the XCP-ng hypervisor and XenServer server virtualization platform, which allows a perpetrator to increase their privileges

The vulnerability of function systemdomains.ml:30-35 in the RBAC access control subsystem of the XCP-ng hypervisor and the XenServer server virtualization platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to elevate their privileges...

The vulnerability of the storage_driver_domain driver in the Role-Based Access Control (RBAC) subsystem of the XCP-ng hypervisor and the XenServer server virtualization platform allows a perpetrator to increase their privileges.

The vulnerability of the storagedriverdomain driver in the Role-Based Access Control RBAC subsystem of the XCP-ng hypervisor and the XenServer server virtualization platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to elevate their...

EUVD-2026-30928

The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status pages via XENMEMaddtophysmap. Some of the status pages may then be freed while...