A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade libguestfs-winsupportUpgrade libvirt-daemonUpgrade libvirt-dbusUpgrade libvirt-wiresharkUpgrade libguestfs-develUpgrade swtpm-toolsUpgrade libvirt-daemon-driver-storage-glusterUpgrade nbdkit-example-pluginsUpgrade nbdkit-gzip-pluginUpgrade libiscsi-utilsUpgrade qemu-guest-agentUpgrade libiscsiUpgrade nbdkit-curl-pluginUpgrade nbdkit-bash-completionUpgrade libguestfs-man-pages-ukUpgrade hivex-develUpgrade qemu-kvm-block-iscsiUpgrade nbdkit-tar-pluginUpgrade python3-libguestfsUpgrade swtpm-tools-pkcs11Upgrade nbdkit-linuxdisk-pluginUpgrade netcfUpgrade nbdkit-vddk-pluginUpgrade libtpmsUpgrade libguestfs-man-pages-jaUpgrade nbdfuseUpgrade qemu-kvm-block-curlUpgrade virt-v2v-bash-completionUpgrade virt-v2v-man-pages-ukUpgrade libguestfs-java-develUpgrade virt-v2v-man-pages-jaUpgrade nbdkit-gzip-filterUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-nodedevUpgrade python3-hivexUpgrade libguestfs-rescueUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-lock-sanlockUpgrade libvirt-develUpgrade libvirt-daemon-driver-storage-coreUpgrade libtpms-develUpgrade libnbd-develUpgrade libguestfs-tools-cUpgrade sgabios-binUpgrade qemu-kvm-block-sshUpgrade qemu-kvm-block-rbdUpgrade qemu-kvmUpgrade perl-Sys-VirtUpgrade nbdkit-xz-filterUpgrade nbdkitUpgrade nbdkit-nbd-pluginUpgrade libnbdUpgrade python3-libvirtUpgrade libguestfsUpgrade netcf-libsUpgrade libguestfs-gobject-develUpgrade libguestfs-bash-completionUpgrade libguestfs-rsyncUpgrade nbdkit-serverUpgrade qemu-kvm-device-usb-hostUpgrade superminUpgrade libguestfs-toolsUpgrade nbdkit-tar-filterUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-interfaceUpgrade perl-Sys-GuestfsUpgrade libvirt-daemon-driver-storage-rbdUpgrade qemu-kvm-coreUpgrade swtpmUpgrade qemu-virtiofsdUpgrade python3-libnbdUpgrade netcf-develUpgrade libguestfs-gobjectUpgrade nbdkit-ssh-pluginUpgrade sgabiosUpgrade libvirt-daemon-kvmUpgrade lua-guestfsUpgrade nbdkit-develUpgrade hivexUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-secretUpgrade libvirt-clientUpgrade nbdkit-tmpdisk-pluginUpgrade supermin-develUpgrade libguestfs-inspect-iconsUpgrade libguestfs-xfsUpgrade libvirt-daemon-driver-storage-logicalUpgrade perl-hivexUpgrade seabiosUpgrade libiscsi-develUpgrade nbdkit-python-pluginUpgrade swtpm-develUpgrade libguestfs-javaUpgrade libguestfs-javadocUpgrade ruby-libguestfsUpgrade seabios-binUpgrade libguestfs-applianceUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-libsUpgrade libvirt-daemon-config-networkUpgrade nbdkit-basic-filtersUpgrade seavgabios-binUpgrade libguestfs-gfs2Upgrade libnbd-bash-completionUpgrade libvirt-client-qemuUpgrade nbdkit-basic-pluginsUpgrade qemu-kvm-commonUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-networkUpgrade virt-v2vUpgrade qemu-kvm-block-glusterUpgrade libvirtUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-nssUpgrade virt-dibUpgrade libvirt-docsUpgrade qemu-imgUpgrade ruby-hivexUpgrade swtpm-libs | Apr 28, 2026 | Dec 14, 2025 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system-s390xUpgrade qemu-system-x86-xenUpgrade qemu-system-ppcUpgrade qemu-system-modules-openglUpgrade qemu-system-armUpgrade qemu-system-modules-spiceUpgrade qemu-system-sparcUpgrade qemu-system-riscvUpgrade qemu-system-miscUpgrade qemu-system-x86Upgrade qemu-system-xenUpgrade qemu-system-guiUpgrade qemu-system-dataUpgrade qemu-system-mipsUpgrade qemu-system-common | Mar 9, 2026 | Mar 4, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub