A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade qemu-userUpgrade qemu-audio-alsaUpgrade qemu-block-curlUpgrade qemu-system-aarch64-coreUpgrade ivshmem-toolsUpgrade qemu-audio-sdlUpgrade qemu-block-iscsiUpgrade qemu-guest-agentUpgrade qemu-block-sshUpgrade qemu-ui-gtkUpgrade qemu-audio-ossUpgrade qemu-block-rbdUpgrade qemu-debuginfoUpgrade qemuUpgrade qemu-block-nfsUpgrade qemu-ui-sdlUpgrade qemu-user-binfmtUpgrade qemu-commonUpgrade qemu-system-x86Upgrade qemu-kvmUpgrade qemu-audio-paUpgrade qemu-system-aarch64Upgrade qemu-imgUpgrade qemu-system-x86-coreUpgrade qemu-block-dmgUpgrade qemu-kvm-coreUpgrade qemu-ui-cursesUpgrade qemu-user-static | May 20, 2026 | May 20, 2026 |
| Debian | — | No solution exists | May 15, 2025 | Sep 19, 2024 |
| Oracle_linux | — | Upgrade libguestfs-man-pages-ukUpgrade libguestfs-winsupportUpgrade libguestfs-javadocUpgrade seabiosUpgrade perl-Sys-GuestfsUpgrade qemu-guest-agentUpgrade libvirt-lock-sanlockUpgrade virt-v2v-man-pages-jaUpgrade qemu-kvmUpgrade nbdkit-tar-filterUpgrade libvirt-daemon-driver-networkUpgrade swtpm-toolsUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-nodedevUpgrade libguestfs-rescueUpgrade virt-v2v-bash-completionUpgrade libvirt-clientUpgrade virt-v2vUpgrade libiscsi-utilsUpgrade qemu-kvm-block-sshUpgrade nbdkit-basic-pluginsUpgrade qemu-kvm-block-rbdUpgrade libvirtUpgrade qemu-kvm-device-usb-hostUpgrade nbdkit-python-pluginUpgrade python3-libnbdUpgrade libvirt-nssUpgrade nbdkit-vddk-pluginUpgrade libtpmsUpgrade libvirt-daemon-driver-storage-glusterUpgrade superminUpgrade nbdkit-tar-pluginUpgrade libguestfs-applianceUpgrade qemu-kvm-block-curlUpgrade libguestfs-gobject-develUpgrade supermin-develUpgrade swtpm-libsUpgrade nbdkit-serverUpgrade libguestfs-xfsUpgrade libiscsi-develUpgrade nbdkit-xz-filterUpgrade libguestfs-toolsUpgrade python3-hivexUpgrade qemu-kvm-block-glusterUpgrade libguestfs-inspect-iconsUpgrade python3-libguestfsUpgrade libnbd-develUpgrade libvirt-daemonUpgrade nbdkit-develUpgrade qemu-kvm-commonUpgrade lua-guestfsUpgrade libvirt-daemon-driver-qemuUpgrade libguestfs-bash-completionUpgrade nbdkit-basic-filtersUpgrade sgabiosUpgrade libvirt-wiresharkUpgrade libguestfsUpgrade libvirt-daemon-config-nwfilterUpgrade hivexUpgrade virt-v2v-man-pages-ukUpgrade qemu-kvm-coreUpgrade libvirt-daemon-driver-storageUpgrade python3-libvirtUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-storage-rbdUpgrade nbdfuseUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-nwfilterUpgrade libiscsiUpgrade libguestfs-javaUpgrade ruby-libguestfsUpgrade nbdkit-gzip-filterUpgrade nbdkit-curl-pluginUpgrade nbdkit-bash-completionUpgrade libguestfs-java-develUpgrade swtpm-tools-pkcs11Upgrade libguestfs-gfs2Upgrade libguestfs-develUpgrade virt-dibUpgrade qemu-kvm-block-iscsiUpgrade nbdkit-example-pluginsUpgrade libvirt-dbusUpgrade libvirt-daemon-driver-secretUpgrade libnbdUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade swtpm-develUpgrade qemu-imgUpgrade netcfUpgrade nbdkit-linuxdisk-pluginUpgrade libvirt-daemon-driver-storage-iscsiUpgrade netcf-libsUpgrade nbdkit-tmpdisk-pluginUpgrade libtpms-develUpgrade sgabios-binUpgrade libguestfs-tools-cUpgrade libguestfs-man-pages-jaUpgrade nbdkit-gzip-pluginUpgrade libvirt-develUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-config-networkUpgrade hivex-develUpgrade nbdkit-nbd-pluginUpgrade libguestfs-rsyncUpgrade libguestfs-gobjectUpgrade seavgabios-binUpgrade netcf-develUpgrade libvirt-docsUpgrade libvirt-daemon-kvmUpgrade perl-Sys-VirtUpgrade perl-hivexUpgrade libnbd-bash-completionUpgrade nbdkit-ssh-pluginUpgrade nbdkitUpgrade swtpmUpgrade libvirt-daemon-driver-storage-scsiUpgrade ruby-hivexUpgrade libvirt-libsUpgrade seabios-binUpgrade qemu-virtiofsdUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-client-qemu | Feb 26, 2026 | Aug 30, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 19, 2024 |
| Suse | — | Upgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-vhost-user-gpuUpgrade qemu-toolsUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-extraUpgrade qemu-sgabiosUpgrade qemu-vgabiosUpgrade qemuUpgrade qemu-hw-usb-smartcardUpgrade qemu-guest-agentUpgrade qemu-hw-display-qxlUpgrade qemu-audio-dbusUpgrade qemu-ppcUpgrade qemu-block-sshUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-SLOFUpgrade qemu-ivshmem-toolsUpgrade qemu-langUpgrade qemu-audio-spiceUpgrade qemu-hw-usb-hostUpgrade qemu-s390xUpgrade qemu-microvmUpgrade qemu-chardev-baumUpgrade qemu-block-nfsUpgrade qemu-ipxeUpgrade qemu-ui-dbusUpgrade qemu-x86Upgrade qemu-audio-jackUpgrade qemu-block-rbdUpgrade qemu-headlessUpgrade qemu-kvmUpgrade qemu-skibootUpgrade qemu-ui-openglUpgrade qemu-ui-gtkUpgrade qemu-pr-helperUpgrade qemu-docUpgrade qemu-block-iscsiUpgrade qemu-block-curlUpgrade qemu-accel-tcg-x86Upgrade qemu-linux-userUpgrade qemu-imgUpgrade qemu-ksmUpgrade qemu-hw-usb-redirectUpgrade qemu-chardev-spiceUpgrade qemu-accel-qtestUpgrade qemu-seabiosUpgrade qemu-block-glusterUpgrade qemu-spiceUpgrade qemu-block-dmgUpgrade qemu-ui-cursesUpgrade qemu-armUpgrade qemu-ui-spice-appUpgrade qemu-audio-paUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ui-spice-coreUpgrade qemu-audio-pipewireUpgrade qemu-audio-alsa | Dec 31, 2024 | Sep 19, 2024 |
| Ubuntu | — | Upgrade qemu-system-s390xUpgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-block-extra (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-user-static (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-common (Ubuntu Pro)Upgrade qemu-system-s390x (Ubuntu Pro)Upgrade qemu-system-x86-xenUpgrade qemu-kvm (Ubuntu Pro)Upgrade qemu-system-x86-microvm (Ubuntu Pro)Upgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-x86-microvmUpgrade qemu-system-modules-openglUpgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-data (Ubuntu Pro)Upgrade qemu-system-modules-spiceUpgrade qemu-system-miscUpgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-commonUpgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-xenUpgrade qemu-user (Ubuntu Pro)Upgrade qemu-system-dataUpgrade qemu-system-ppcUpgrade qemu-user-binfmt (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemu-utils (Ubuntu Pro)Upgrade qemu-system-riscvUpgrade qemu-system-gui (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemuUpgrade qemu-system-x86-xen (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-guest-agent (Ubuntu Pro)Upgrade qemu-system-guiUpgrade qemu-keymaps (Ubuntu Pro)Upgrade qemu-system | Jun 26, 2025 | Sep 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub