An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade libvirtUpgrade nbdkit-xz-filterUpgrade nbdkit-tar-filterUpgrade libvirt-lock-sanlockUpgrade libguestfs-applianceUpgrade qemu-kvm-device-usb-hostUpgrade libvirt-daemon-driver-storage-coreUpgrade qemu-kvmUpgrade libguestfs-bash-completionUpgrade libvirt-daemon-driver-networkUpgrade swtpm-toolsUpgrade qemu-kvm-block-rbdUpgrade qemu-kvm-block-glusterUpgrade qemu-guest-agentUpgrade python3-libguestfsUpgrade virt-v2v-man-pages-jaUpgrade python3-hivexUpgrade libtpmsUpgrade libguestfs-winsupportUpgrade supermin-develUpgrade nbdkit-serverUpgrade libguestfs-inspect-iconsUpgrade nbdkit-gzip-pluginUpgrade libguestfs-man-pages-ukUpgrade libvirt-daemonUpgrade nbdkit-basic-pluginsUpgrade libguestfs-xfsUpgrade libguestfs-rescueUpgrade python3-libnbdUpgrade libvirt-daemon-driver-storage-glusterUpgrade virt-v2v-bash-completionUpgrade swtpm-libsUpgrade libnbd-develUpgrade nbdkit-basic-filtersUpgrade python3-libvirtUpgrade nbdkit-tar-pluginUpgrade nbdkit-develUpgrade lua-guestfsUpgrade libvirt-daemon-driver-nodedevUpgrade libiscsi-utilsUpgrade perl-Sys-GuestfsUpgrade libguestfsUpgrade qemu-kvm-block-sshUpgrade seabiosUpgrade libnbdUpgrade nbdkit-python-pluginUpgrade libiscsi-develUpgrade nbdkit-vddk-pluginUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-clientUpgrade libguestfs-gobject-develUpgrade libvirt-nssUpgrade qemu-kvm-block-curlUpgrade libvirt-wiresharkUpgrade nbdkit-ssh-pluginUpgrade nbdkit-curl-pluginUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libnbd-bash-completionUpgrade libguestfs-tools-cUpgrade qemu-kvm-coreUpgrade superminUpgrade perl-hivexUpgrade libguestfs-develUpgrade ruby-hivexUpgrade libvirt-develUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-client-qemuUpgrade libtpms-develUpgrade libguestfs-rsyncUpgrade libguestfs-java-develUpgrade nbdkit-gzip-filterUpgrade nbdkitUpgrade libvirt-docsUpgrade libvirt-daemon-driver-storage-diskUpgrade qemu-imgUpgrade qemu-kvm-block-iscsiUpgrade swtpmUpgrade virt-dibUpgrade nbdkit-example-pluginsUpgrade qemu-virtiofsdUpgrade seabios-binUpgrade qemu-kvm-commonUpgrade libguestfs-gobjectUpgrade nbdkit-tmpdisk-pluginUpgrade libiscsiUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-config-nwfilterUpgrade libguestfs-gfs2Upgrade nbdkit-nbd-pluginUpgrade libvirt-daemon-kvmUpgrade virt-v2vUpgrade ruby-libguestfsUpgrade nbdfuseUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-config-networkUpgrade perl-Sys-VirtUpgrade libvirt-daemon-driver-storage-mpathUpgrade swtpm-develUpgrade swtpm-tools-pkcs11Upgrade sgabios-binUpgrade netcf-develUpgrade nbdkit-bash-completionUpgrade libvirt-dbusUpgrade libguestfs-toolsUpgrade libguestfs-javaUpgrade hivexUpgrade sgabiosUpgrade libvirt-libsUpgrade libguestfs-javadocUpgrade hivex-develUpgrade libguestfs-man-pages-jaUpgrade netcf-libsUpgrade libvirt-daemon-driver-interfaceUpgrade virt-v2v-man-pages-ukUpgrade seavgabios-binUpgrade nbdkit-linuxdisk-pluginUpgrade netcf | Apr 28, 2026 | Jan 9, 2026 |
| Suse | — | Upgrade qemu-ipxeUpgrade qemu-ui-spice-coreUpgrade qemu-accel-qtestUpgrade qemu-armUpgrade qemu-docUpgrade qemu-block-iscsiUpgrade qemu-hw-usb-redirectUpgrade qemu-block-curlUpgrade qemu-audio-paUpgrade qemu-block-glusterUpgrade qemu-ui-gtkUpgrade qemu-block-dmgUpgrade qemu-ui-spice-appUpgrade qemu-skibootUpgrade qemu-ui-cursesUpgrade qemu-accel-tcg-x86Upgrade qemu-spiceUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ksmUpgrade qemu-ui-openglUpgrade qemu-audio-ossUpgrade qemu-pr-helperUpgrade qemu-seabiosUpgrade qemu-audio-alsaUpgrade qemu-imgUpgrade qemu-linux-userUpgrade qemu-chardev-spiceUpgrade qemu-audio-pipewireUpgrade qemu-ppcUpgrade qemu-microvmUpgrade qemu-hw-display-qxlUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-vhost-user-gpuUpgrade qemu-block-nfsUpgrade qemu-ivshmem-toolsUpgrade qemu-audio-spiceUpgrade qemuUpgrade qemu-guest-agentUpgrade qemu-vmsr-helperUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-extraUpgrade qemu-toolsUpgrade qemu-langUpgrade qemu-audio-dbusUpgrade qemu-hw-usb-smartcardUpgrade qemu-chardev-baumUpgrade qemu-block-rbdUpgrade qemu-SLOFUpgrade qemu-hw-usb-hostUpgrade qemu-audio-jackUpgrade qemu-x86Upgrade qemu-ui-dbusUpgrade qemu-s390xUpgrade qemu-vgabiosUpgrade qemu-headlessUpgrade qemu-block-ssh | Feb 12, 2026 | Feb 11, 2026 |
| Ubuntu | — | Upgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-guiUpgrade qemu-system-commonUpgrade qemu-system-modules-spiceUpgrade qemu-system-xenUpgrade qemu-system-dataUpgrade qemu-system-mipsUpgrade qemu-system-miscUpgrade qemu-system-x86Upgrade qemu-system-s390xUpgrade qemu-system-x86-xenUpgrade qemu-system-modules-openglUpgrade qemu-system-sparcUpgrade qemu-system-riscvUpgrade qemu-system-arm | Mar 9, 2026 | Mar 4, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub