CVE-2026-9238
qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.
Security Fix(es):
A security vulnerability exists in QEMU, the details of which have not been fully disclosed.(CVE-2026-15578)
CVE-2026-15705 is an undisclosed vulnerability in QEMU. The vulnerability has been identified in QEMU, but specific technical details and impact scope have not yet been publicly disclosed.(CVE-2026-15705)
A security vulnerability exists in QEMU. Detailed vulnerability information has not yet been disclosed. This vulnerability affects all versions.(CVE-2026-16043)
In the Linux kernel, the following vulnerabilities have been addressed: bpf: Support hardened BPF for JIT injection. The JIT allocator packages many small programs into larger executable allocations and reuses space in these allocations, loading and freeing them just like programs. When new code is written to the space of the previous code, the program is occupied, and indirect jumps to the new program can reuse the oracles left by the old oracles in the branch. Flush indirect branch predictors before reusing JIT memory so that indirect jumps to a newly written program do not reuse predictions from an old program that occupies the same space. Introduced bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for refreshing the branch predictor of JIT memory reuse. Schemas that need to be refreshed can update them with the predictor refresh function. By default, it is a NOP and no CALLs will be issued. Allocations larger than the package are not covered by this flush. That's safe because the cBPF program (unprivileged attack surface) is well constrained below the package size. If this assumption is violated, a warning is issued while flushing is active.(CVE-2026-61475)
An undisclosed vulnerability exists in QEMU, with no detailed vulnerability description available at this time.(CVE-2026-63319)
An undisclosed vulnerability exists in QEMU. Currently, only limited vulnerability information is available, and the specific impact scope and details have not been publicly disclosed.(CVE-2026-8348)
An undisclosed vulnerability exists in QEMU, the details of which have not yet been publicly disclosed.(CVE-2026-9238)
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
OSV Score usedOESA-2026-3273
qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.
Security Fix(es):
A security vulnerability exists in QEMU, the details of which have not been fully disclosed.(CVE-2026-15578)
CVE-2026-15705 is an undisclosed vulnerability in QEMU. The vulnerability has been identified in QEMU, but specific technical details and impact scope have not yet been publicly disclosed.(CVE-2026-15705)
A security vulnerability exists in QEMU. Detailed vulnerability information has not yet been disclosed. This vulnerability affects all versions.(CVE-2026-16043)
In the Linux kernel, the following vulnerabilities have been addressed: bpf: Support hardened BPF for JIT injection. The JIT allocator packages many small programs into larger executable allocations and reuses space in these allocations, loading and freeing them just like programs. When new code is written to the space of the previous code, the program is occupied, and indirect jumps to the new program can reuse the oracles left by the old oracles in the branch. Flush indirect branch predictors before reusing JIT memory so that indirect jumps to a newly written program do not reuse predictions from an old program that occupies the same space. Introduced bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for refreshing the branch predictor of JIT memory reuse. Schemas that need to be refreshed can update them with the predictor refresh function. By default, it is a NOP and no CALLs will be issued. Allocations larger than the package are not covered by this flush. That's safe because the cBPF program (unprivileged attack surface) is well constrained below the package size. If this assumption is violated, a warning is issued while flushing is active.(CVE-2026-61475)
An undisclosed vulnerability exists in QEMU, with no detailed vulnerability description available at this time.(CVE-2026-63319)
An undisclosed vulnerability exists in QEMU. Currently, only limited vulnerability information is available, and the specific impact scope and details have not been publicly disclosed.(CVE-2026-8348)
An undisclosed vulnerability exists in QEMU, the details of which have not yet been publicly disclosed.(CVE-2026-9238)
- Record
OESA-2026-3273- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-3274
qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.
Security Fix(es):
A security vulnerability exists in QEMU, the details of which have not been fully disclosed.(CVE-2026-15578)
CVE-2026-15705 is an undisclosed vulnerability in QEMU. The vulnerability has been identified in QEMU, but specific technical details and impact scope have not yet been publicly disclosed.(CVE-2026-15705)
A security vulnerability exists in QEMU. Detailed vulnerability information has not yet been disclosed. This vulnerability affects all versions.(CVE-2026-16043)
In the Linux kernel, the following vulnerabilities have been addressed: bpf: Support hardened BPF for JIT injection. The JIT allocator packages many small programs into larger executable allocations and reuses space in these allocations, loading and freeing them just like programs. When new code is written to the space of the previous code, the program is occupied, and indirect jumps to the new program can reuse the oracles left by the old oracles in the branch. Flush indirect branch predictors before reusing JIT memory so that indirect jumps to a newly written program do not reuse predictions from an old program that occupies the same space. Introduced bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for refreshing the branch predictor of JIT memory reuse. Schemas that need to be refreshed can update them with the predictor refresh function. By default, it is a NOP and no CALLs will be issued. Allocations larger than the package are not covered by this flush. That's safe because the cBPF program (unprivileged attack surface) is well constrained below the package size. If this assumption is violated, a warning is issued while flushing is active.(CVE-2026-61475)
An undisclosed vulnerability exists in QEMU, with no detailed vulnerability description available at this time.(CVE-2026-63319)
An undisclosed vulnerability exists in QEMU. Currently, only limited vulnerability information is available, and the specific impact scope and details have not been publicly disclosed.(CVE-2026-8348)
An undisclosed vulnerability exists in QEMU, the details of which have not yet been publicly disclosed.(CVE-2026-9238)
- Record
OESA-2026-3274- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-3275
qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.
Security Fix(es):
A security vulnerability exists in QEMU, the details of which have not been fully disclosed.(CVE-2026-15578)
CVE-2026-15705 is an undisclosed vulnerability in QEMU. The vulnerability has been identified in QEMU, but specific technical details and impact scope have not yet been publicly disclosed.(CVE-2026-15705)
A security vulnerability exists in QEMU. Detailed vulnerability information has not yet been disclosed. This vulnerability affects all versions.(CVE-2026-16043)
In the Linux kernel, the following vulnerabilities have been addressed: bpf: Support hardened BPF for JIT injection. The JIT allocator packages many small programs into larger executable allocations and reuses space in these allocations, loading and freeing them just like programs. When new code is written to the space of the previous code, the program is occupied, and indirect jumps to the new program can reuse the oracles left by the old oracles in the branch. Flush indirect branch predictors before reusing JIT memory so that indirect jumps to a newly written program do not reuse predictions from an old program that occupies the same space. Introduced bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for refreshing the branch predictor of JIT memory reuse. Schemas that need to be refreshed can update them with the predictor refresh function. By default, it is a NOP and no CALLs will be issued. Allocations larger than the package are not covered by this flush. That's safe because the cBPF program (unprivileged attack surface) is well constrained below the package size. If this assumption is violated, a warning is issued while flushing is active.(CVE-2026-61475)
An undisclosed vulnerability exists in QEMU, with no detailed vulnerability description available at this time.(CVE-2026-63319)
An undisclosed vulnerability exists in QEMU. Currently, only limited vulnerability information is available, and the specific impact scope and details have not been publicly disclosed.(CVE-2026-8348)
An undisclosed vulnerability exists in QEMU, the details of which have not yet been publicly disclosed.(CVE-2026-9238)
- Record
OESA-2026-3275- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-3276
qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.
Security Fix(es):
A security vulnerability exists in QEMU, the details of which have not been fully disclosed.(CVE-2026-15578)
CVE-2026-15705 is an undisclosed vulnerability in QEMU. The vulnerability has been identified in QEMU, but specific technical details and impact scope have not yet been publicly disclosed.(CVE-2026-15705)
A security vulnerability exists in QEMU. Detailed vulnerability information has not yet been disclosed. This vulnerability affects all versions.(CVE-2026-16043)
In the Linux kernel, the following vulnerabilities have been addressed: bpf: Support hardened BPF for JIT injection. The JIT allocator packages many small programs into larger executable allocations and reuses space in these allocations, loading and freeing them just like programs. When new code is written to the space of the previous code, the program is occupied, and indirect jumps to the new program can reuse the oracles left by the old oracles in the branch. Flush indirect branch predictors before reusing JIT memory so that indirect jumps to a newly written program do not reuse predictions from an old program that occupies the same space. Introduced bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush static call for refreshing the branch predictor of JIT memory reuse. Schemas that need to be refreshed can update them with the predictor refresh function. By default, it is a NOP and no CALLs will be issued. Allocations larger than the package are not covered by this flush. That's safe because the cBPF program (unprivileged attack surface) is well constrained below the package size. If this assumption is violated, a warning is issued while flushing is active.(CVE-2026-61475)
An undisclosed vulnerability exists in QEMU, with no detailed vulnerability description available at this time.(CVE-2026-63319)
An undisclosed vulnerability exists in QEMU. Currently, only limited vulnerability information is available, and the specific impact scope and details have not been publicly disclosed.(CVE-2026-8348)
An undisclosed vulnerability exists in QEMU, the details of which have not yet been publicly disclosed.(CVE-2026-9238)
- Record
OESA-2026-3276- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-9238 No score
[hw/9pfs: cap Treaddir allocation]
- Record
UBUNTU-CVE-2026-9238- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuAlpaquita:25 |
10.0.0-r1 up to 10.0.12-r0 | 10.0.12-r0 |
qemuAlpaquita:stream |
8.0.2-r0 up to 11.0.3-r0 | 11.0.3-r0 |
qemuDebian:12 |
All versions, plus listed versions 1:10.0.0+ds-11:10.0.0+ds-21:10.0.0+ds-2~bpo12+11:10.0.0+ds-2~bpo12+21:10.0.0~rc0+ds-1 Show 45 moreShow less1:10.0.0~rc0+ds-21:10.0.0~rc1+ds-11:10.0.0~rc1+ds-21:10.0.0~rc2+ds-11:10.0.0~rc2+ds-21:10.0.0~rc3+ds-11:10.0.0~rc3+ds-21:10.0.2+ds-11:10.0.2+ds-21:10.0.2+ds-2~bpo12+11:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-41:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0+ds-11:11.0.0+ds-21:11.0.0~rc0+ds-11:11.0.0~rc0+ds-2 |
None known |
qemuDebian:13 |
before 1:10.0.12+ds-0+deb13u1, plus listed versions 1:10.0.10+ds-0+deb13u11:10.0.11+ds-0+deb13u11:10.0.2+ds-21:10.0.2+ds-2+deb13u11:10.0.2+ds-2+deb13u1~bpo12+1 Show 9 moreShow less1:10.0.3+ds-0+deb13u11:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-41:10.0.6+ds-0+deb13u11:10.0.6+ds-0+deb13u21:10.0.7+ds-0+deb13u11:10.0.8+ds-0+deb13u1 |
1:10.0.12+ds-0+deb13u1 |
qemuDebian:14 |
before 1:11.0.3+ds-1, plus listed versions 1:10.0.2+ds-21:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-4 Show 41 moreShow less1:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0+ds-11:11.0.0+ds-21:11.0.0~rc0+ds-11:11.0.0~rc0+ds-21:11.0.0~rc1+ds-11:11.0.0~rc1+ds-21:11.0.0~rc1+ds-31:11.0.0~rc2+ds-11:11.0.0~rc2+ds-21:11.0.0~rc3+ds-11:11.0.1+ds-11:11.0.2+ds-11:11.0.2+ds-21:11.0.2+ds-2~bpo13+1 |
1:11.0.3+ds-1 |
qemuopenEuler:22.03-LTS-SP4 From an advisory covering 7 CVEs |
before 6.2.0-117.oe2203sp4 | 6.2.0-117.oe2203sp4 |
qemuopenEuler:24.03-LTS-SP1 From an advisory covering 7 CVEs |
before 8.2.0-59.oe2403sp1 | 8.2.0-59.oe2403sp1 |
qemuopenEuler:24.03-LTS-SP3 From an advisory covering 7 CVEs |
before 8.2.0-83.oe2403sp3 | 8.2.0-83.oe2403sp3 |
qemuopenEuler:24.03-LTS-SP4 From an advisory covering 7 CVEs |
before 8.2.0-83.oe2403sp4 | 8.2.0-83.oe2403sp4 |
qemuUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.5.0+dfsg-3ubuntu51.5.0+dfsg-3ubuntu61.6.0+dfsg-2ubuntu11.6.0+dfsg-2ubuntu21.6.0+dfsg-2ubuntu3 Show 45 moreShow less1.6.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu11.7.0+dfsg-2ubuntu21.7.0+dfsg-2ubuntu31.7.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu51.7.0+dfsg-2ubuntu71.7.0+dfsg-2ubuntu81.7.0+dfsg-2ubuntu91.7.0+dfsg-3ubuntu1~ppa11.7.0+dfsg-3ubuntu11.7.0+dfsg-3ubuntu21.7.0+dfsg-3ubuntu31.7.0+dfsg-3ubuntu41.7.0+dfsg-3ubuntu51.7.0+dfsg-3ubuntu61.7.0+dfsg-3ubuntu72.0.0~rc1+dfsg-0ubuntu12.0.0~rc1+dfsg-0ubuntu22.0.0~rc1+dfsg-0ubuntu32.0.0~rc1+dfsg-0ubuntu3.12.0.0+dfsg-2ubuntu12.0.0+dfsg-2ubuntu1.12.0.0+dfsg-2ubuntu1.22.0.0+dfsg-2ubuntu1.32.0.0+dfsg-2ubuntu1.52.0.0+dfsg-2ubuntu1.62.0.0+dfsg-2ubuntu1.72.0.0+dfsg-2ubuntu1.82.0.0+dfsg-2ubuntu1.92.0.0+dfsg-2ubuntu1.102.0.0+dfsg-2ubuntu1.112.0.0+dfsg-2ubuntu1.132.0.0+dfsg-2ubuntu1.142.0.0+dfsg-2ubuntu1.152.0.0+dfsg-2ubuntu1.162.0.0+dfsg-2ubuntu1.172.0.0+dfsg-2ubuntu1.182.0.0+dfsg-2ubuntu1.192.0.0+dfsg-2ubuntu1.202.0.0+dfsg-2ubuntu1.212.0.0+dfsg-2ubuntu1.222.0.0+dfsg-2ubuntu1.242.0.0+dfsg-2ubuntu1.252.0.0+dfsg-2ubuntu1.26 |
None known |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qemuUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:2.3+dfsg-5ubuntu91:2.3+dfsg-5ubuntu101:2.4+dfsg-4ubuntu11:2.4+dfsg-4ubuntu21:2.4+dfsg-4ubuntu3 Show 45 moreShow less1:2.4+dfsg-5ubuntu31:2.5+dfsg-1ubuntu21:2.5+dfsg-1ubuntu31:2.5+dfsg-1ubuntu41:2.5+dfsg-1ubuntu51:2.5+dfsg-5ubuntu11:2.5+dfsg-5ubuntu21:2.5+dfsg-5ubuntu41:2.5+dfsg-5ubuntu61:2.5+dfsg-5ubuntu71:2.5+dfsg-5ubuntu101:2.5+dfsg-5ubuntu10.11:2.5+dfsg-5ubuntu10.21:2.5+dfsg-5ubuntu10.31:2.5+dfsg-5ubuntu10.41:2.5+dfsg-5ubuntu10.51:2.5+dfsg-5ubuntu10.61:2.5+dfsg-5ubuntu10.71:2.5+dfsg-5ubuntu10.81:2.5+dfsg-5ubuntu10.91:2.5+dfsg-5ubuntu10.101:2.5+dfsg-5ubuntu10.111:2.5+dfsg-5ubuntu10.131:2.5+dfsg-5ubuntu10.141:2.5+dfsg-5ubuntu10.151:2.5+dfsg-5ubuntu10.161:2.5+dfsg-5ubuntu10.201:2.5+dfsg-5ubuntu10.211:2.5+dfsg-5ubuntu10.221:2.5+dfsg-5ubuntu10.241:2.5+dfsg-5ubuntu10.251:2.5+dfsg-5ubuntu10.261:2.5+dfsg-5ubuntu10.281:2.5+dfsg-5ubuntu10.291:2.5+dfsg-5ubuntu10.301:2.5+dfsg-5ubuntu10.311:2.5+dfsg-5ubuntu10.321:2.5+dfsg-5ubuntu10.331:2.5+dfsg-5ubuntu10.341:2.5+dfsg-5ubuntu10.351:2.5+dfsg-5ubuntu10.361:2.5+dfsg-5ubuntu10.371:2.5+dfsg-5ubuntu10.381:2.5+dfsg-5ubuntu10.391:2.5+dfsg-5ubuntu10.40 |
None known |
qemuUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:2.10+dfsg-0ubuntu31:2.10+dfsg-0ubuntu41:2.10+dfsg-0ubuntu51:2.11+dfsg-1ubuntu11:2.11+dfsg-1ubuntu2 Show 45 moreShow less1:2.11+dfsg-1ubuntu41:2.11+dfsg-1ubuntu51:2.11+dfsg-1ubuntu61:2.11+dfsg-1ubuntu71:2.11+dfsg-1ubuntu7.11:2.11+dfsg-1ubuntu7.21:2.11+dfsg-1ubuntu7.31:2.11+dfsg-1ubuntu7.41:2.11+dfsg-1ubuntu7.51:2.11+dfsg-1ubuntu7.61:2.11+dfsg-1ubuntu7.71:2.11+dfsg-1ubuntu7.81:2.11+dfsg-1ubuntu7.91:2.11+dfsg-1ubuntu7.101:2.11+dfsg-1ubuntu7.121:2.11+dfsg-1ubuntu7.131:2.11+dfsg-1ubuntu7.141:2.11+dfsg-1ubuntu7.151:2.11+dfsg-1ubuntu7.171:2.11+dfsg-1ubuntu7.181:2.11+dfsg-1ubuntu7.191:2.11+dfsg-1ubuntu7.201:2.11+dfsg-1ubuntu7.211:2.11+dfsg-1ubuntu7.221:2.11+dfsg-1ubuntu7.231:2.11+dfsg-1ubuntu7.251:2.11+dfsg-1ubuntu7.261:2.11+dfsg-1ubuntu7.271:2.11+dfsg-1ubuntu7.281:2.11+dfsg-1ubuntu7.291:2.11+dfsg-1ubuntu7.311:2.11+dfsg-1ubuntu7.321:2.11+dfsg-1ubuntu7.331:2.11+dfsg-1ubuntu7.341:2.11+dfsg-1ubuntu7.351:2.11+dfsg-1ubuntu7.361:2.11+dfsg-1ubuntu7.371:2.11+dfsg-1ubuntu7.381:2.11+dfsg-1ubuntu7.391:2.11+dfsg-1ubuntu7.401:2.11+dfsg-1ubuntu7.411:2.11+dfsg-1ubuntu7.421:2.11+dfsg-1ubuntu7.42+esm11:2.11+dfsg-1ubuntu7.42+esm21:2.11+dfsg-1ubuntu7.42+esm5 |
None known |
qemuUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:4.0+dfsg-0ubuntu91:4.0+dfsg-0ubuntu101:4.2-1ubuntu11:4.2-1ubuntu21:4.2-3ubuntu1 Show 35 moreShow less1:4.2-3ubuntu21:4.2-3ubuntu31:4.2-3ubuntu41:4.2-3ubuntu51:4.2-3ubuntu61:4.2-3ubuntu6.11:4.2-3ubuntu6.21:4.2-3ubuntu6.31:4.2-3ubuntu6.41:4.2-3ubuntu6.51:4.2-3ubuntu6.61:4.2-3ubuntu6.71:4.2-3ubuntu6.81:4.2-3ubuntu6.91:4.2-3ubuntu6.101:4.2-3ubuntu6.111:4.2-3ubuntu6.121:4.2-3ubuntu6.141:4.2-3ubuntu6.151:4.2-3ubuntu6.161:4.2-3ubuntu6.171:4.2-3ubuntu6.181:4.2-3ubuntu6.191:4.2-3ubuntu6.211:4.2-3ubuntu6.231:4.2-3ubuntu6.241:4.2-3ubuntu6.251:4.2-3ubuntu6.261:4.2-3ubuntu6.271:4.2-3ubuntu6.281:4.2-3ubuntu6.291:4.2-3ubuntu6.301:4.2-3ubuntu6.30+esm11:4.2-3ubuntu6.30+esm21:4.2-3ubuntu6.30+esm3 |
None known |
qemuUbuntu:22.04:LTS |
All versions, plus listed versions 1:6.0+dfsg-2expubuntu11:6.0+dfsg-2expubuntu21:6.0+dfsg-2expubuntu41:6.2+dfsg-2ubuntu51:6.2+dfsg-2ubuntu6 Show 30 moreShow less1:6.2+dfsg-2ubuntu6.11:6.2+dfsg-2ubuntu6.21:6.2+dfsg-2ubuntu6.31:6.2+dfsg-2ubuntu6.41:6.2+dfsg-2ubuntu6.51:6.2+dfsg-2ubuntu6.61:6.2+dfsg-2ubuntu6.71:6.2+dfsg-2ubuntu6.81:6.2+dfsg-2ubuntu6.91:6.2+dfsg-2ubuntu6.101:6.2+dfsg-2ubuntu6.111:6.2+dfsg-2ubuntu6.121:6.2+dfsg-2ubuntu6.131:6.2+dfsg-2ubuntu6.141:6.2+dfsg-2ubuntu6.151:6.2+dfsg-2ubuntu6.161:6.2+dfsg-2ubuntu6.171:6.2+dfsg-2ubuntu6.181:6.2+dfsg-2ubuntu6.191:6.2+dfsg-2ubuntu6.211:6.2+dfsg-2ubuntu6.221:6.2+dfsg-2ubuntu6.231:6.2+dfsg-2ubuntu6.241:6.2+dfsg-2ubuntu6.251:6.2+dfsg-2ubuntu6.261:6.2+dfsg-2ubuntu6.271:6.2+dfsg-2ubuntu6.281:6.2+dfsg-2ubuntu6.291:6.2+dfsg-2ubuntu6.301:6.2+dfsg-2ubuntu6.31 |
None known |
qemuUbuntu:24.04:LTS |
All versions, plus listed versions 1:8.0.4+dfsg-1ubuntu31:8.0.4+dfsg-1ubuntu41:8.0.4+dfsg-1ubuntu51:8.1.3+ds-1ubuntu21:8.2.1+ds-1ubuntu1 Show 19 moreShow less1:8.2.1+ds-1ubuntu81:8.2.1+ds-1ubuntu91:8.2.2+ds-0ubuntu11:8.2.2+ds-0ubuntu1.21:8.2.2+ds-0ubuntu1.41:8.2.2+ds-0ubuntu1.51:8.2.2+ds-0ubuntu1.61:8.2.2+ds-0ubuntu1.71:8.2.2+ds-0ubuntu1.81:8.2.2+ds-0ubuntu1.91:8.2.2+ds-0ubuntu1.101:8.2.2+ds-0ubuntu1.111:8.2.2+ds-0ubuntu1.121:8.2.2+ds-0ubuntu1.131:8.2.2+ds-0ubuntu1.141:8.2.2+ds-0ubuntu1.151:8.2.2+ds-0ubuntu1.161:8.2.2+ds-0ubuntu1.171:8.2.2+ds-0ubuntu1.18 |
None known |
qemuUbuntu:26.10 |
All versions, plus listed versions 1:10.2.1+ds-1ubuntu31:10.2.1+ds-1ubuntu61:11.0.3+ds-2ubuntu11:11.0.3+ds-2ubuntu2 |
None known |
qemu-hweUbuntu:26.10 |
All versions, plus listed versions 1:10.2.1+ds-1ubuntu41:10.2.1+ds-1ubuntu71:10.2.1+ds-1ubuntu81:11.0.3+ds-2ubuntu21:11.0.3+ds-2ubuntu4 |
None known |
qemuUbuntu:26.04:LTS |
All versions, plus listed versions 1:10.1.0+ds-5ubuntu21:10.1.0+ds-5ubuntu31:10.1.0+ds-5ubuntu41:10.1.0+ds-5ubuntu51:10.2.1+ds-1ubuntu1 Show 5 moreShow less1:10.2.1+ds-1ubuntu21:10.2.1+ds-1ubuntu31:10.2.1+ds-1ubuntu3.11:10.2.1+ds-1ubuntu3.21:10.2.1+ds-1ubuntu3.3 |
None known |
qemu-hweUbuntu:26.04:LTS |
All versions, plus listed versions 1:10.2.1+ds-1ubuntu21:10.2.1+ds-1ubuntu41:10.2.1+ds-1ubuntu4.21:10.2.1+ds-1ubuntu4.31:10.2.1+ds-1ubuntu4.4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-9238 is a high vulnerability (CVSS 8.2) in qemu, published July 26, 2026. No source lists public exploit code. Fixed in qemu 10.0.12-r0.
References
docs.bell-sw.com/security/cves/CVE-2026-9238
security-tracker.debian.org/tracker/CVE-2026-9238
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3273
nvd.nist.gov/vuln/detail/CVE-2026-15578
Show 9 moreShow less
ubuntu.com/security/CVE-2026-9238
cve.org/CVERecord?id=CVE-2026-9238
Left out here: 189 versions. The JSON record has them.