CVE-2025-11234

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

An "off by one" bug has been discovered in QEMU's KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

An "off by one" bug has been discovered in QEMU's KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

An "off by one" bug has been discovered in QEMU's KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

• qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

• qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

• qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

• qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

• CVE-2025-11234: io: use-after-free in websocket handshake code
• Bump leading release 14 -> 15 to overcome rpm-version-rank trap: previously released wrong-dist builds tagged .el9 outrank the correctly-tagged .el9_2 builds, blocking the proper release to stable. No source/code changes vs els9.

• CVE-2025-11234: fix use-after-free in QIOChannelWebsock handshake by tracking the handshake GSource id and removing it on close/finalize

These are all security issues fixed in the qemu-10.1.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

Update to version 10.0.7.

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• Version 10.0.7:

  • kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
  • docs/devel: Update URL for make-pullreq script
  • target/arm: Fix assert on BRA.
  • hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
  • hw/core/machine: Provide a description for aux-ram-share property
  • hw/pci: Make msix_init take a uint32_t for nentries
  • block/io_uring: avoid potentially getting stuck after resubmit at the end of ioq_submit()
  • block-backend: Fix race when resuming queued requests
  • ui/vnc: Fix qemu abort when query vnc info
  • chardev/char-pty: Do not ignore chr_write() failures
  • hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
  • hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
  • hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure
  • migration: Fix transition to COLO state from precopy
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• Version 10.0.6:

  • linux-user/microblaze: Fix little-endianness binary
  • target/hppa: correct size bit parity for fmpyadd
  • target/i386: user: do not set up a valid LDT on reset
  • async: access bottom half flags with qatomic_read
  • target/i386: fix x86_64 pushw op
  • i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit
  • i386/cpu: Prevent delivering SIPI during SMM in TCG mode
  • i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS
  • target/i386: Fix CR2 handling for non-canonical addresses
  • block/curl.c: Use explicit long constants in curl_easy_setopt calls
  • pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs
  • target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN2 and SEWd
  • target/riscv: Fix ssamoswap error handling
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• Version 10.0.5:

  • tests/functional/test_aarch64_sbsaref_freebsd: Fix the URL of the ISO image
  • tests/functional/test_ppc_bamboo: Replace broken link with working assets
  • physmem: Destroy all CPU AddressSpaces on unrealize
  • memory: New AS helper to serialize destroy+free
  • include/system/memory.h: Clarify address_space_destroy() behaviour
  • migration: Fix state transition in postcopy_start() error handling
  • target/riscv: rvv: Modify minimum VLEN according to enabled vector extensions
  • target/riscv: rvv: Replace checking V by checking Zve32x
  • target/riscv: Fix endianness swap on compressed instructions
  • hw/riscv/riscv-iommu: Fixup PDT Nested Walk
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).

• [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).

This update for qemu fixes the following issues:

Update to version 10.0.7.

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• Version 10.0.7:

  • kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
  • docs/devel: Update URL for make-pullreq script
  • target/arm: Fix assert on BRA.
  • hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
  • hw/core/machine: Provide a description for aux-ram-share property
  • hw/pci: Make msix_init take a uint32_t for nentries
  • block/io_uring: avoid potentially getting stuck after resubmit at the end of ioq_submit()
  • block-backend: Fix race when resuming queued requests
  • ui/vnc: Fix qemu abort when query vnc info
  • chardev/char-pty: Do not ignore chr_write() failures
  • hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
  • hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
  • hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure
  • migration: Fix transition to COLO state from precopy
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• Version 10.0.6:

  • linux-user/microblaze: Fix little-endianness binary
  • target/hppa: correct size bit parity for fmpyadd
  • target/i386: user: do not set up a valid LDT on reset
  • async: access bottom half flags with qatomic_read
  • target/i386: fix x86_64 pushw op
  • i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit
  • i386/cpu: Prevent delivering SIPI during SMM in TCG mode
  • i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS
  • target/i386: Fix CR2 handling for non-canonical addresses
  • block/curl.c: Use explicit long constants in curl_easy_setopt calls
  • pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs
  • target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN2 and SEWd
  • target/riscv: Fix ssamoswap error handling
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• Version 10.0.5:

  • tests/functional/test_aarch64_sbsaref_freebsd: Fix the URL of the ISO image
  • tests/functional/test_ppc_bamboo: Replace broken link with working assets
  • physmem: Destroy all CPU AddressSpaces on unrealize
  • memory: New AS helper to serialize destroy+free
  • include/system/memory.h: Clarify address_space_destroy() behaviour
  • migration: Fix state transition in postcopy_start() error handling
  • target/riscv: rvv: Modify minimum VLEN according to enabled vector extensions
  • target/riscv: rvv: Replace checking V by checking Zve32x
  • target/riscv: Fix endianness swap on compressed instructions
  • hw/riscv/riscv-iommu: Fixup PDT Nested Walk
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).

• [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).

This update for qemu fixes the following issues:

Update to version 10.0.7.

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• Version 10.0.7:

  • kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
  • docs/devel: Update URL for make-pullreq script
  • target/arm: Fix assert on BRA.
  • hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
  • hw/core/machine: Provide a description for aux-ram-share property
  • hw/pci: Make msix_init take a uint32_t for nentries
  • block/io_uring: avoid potentially getting stuck after resubmit at the end of ioq_submit()
  • block-backend: Fix race when resuming queued requests
  • ui/vnc: Fix qemu abort when query vnc info
  • chardev/char-pty: Do not ignore chr_write() failures
  • hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
  • hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
  • hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure
  • migration: Fix transition to COLO state from precopy
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• Version 10.0.6:

  • linux-user/microblaze: Fix little-endianness binary
  • target/hppa: correct size bit parity for fmpyadd
  • target/i386: user: do not set up a valid LDT on reset
  • async: access bottom half flags with qatomic_read
  • target/i386: fix x86_64 pushw op
  • i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit
  • i386/cpu: Prevent delivering SIPI during SMM in TCG mode
  • i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS
  • target/i386: Fix CR2 handling for non-canonical addresses
  • block/curl.c: Use explicit long constants in curl_easy_setopt calls
  • pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs
  • target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN2 and SEWd
  • target/riscv: Fix ssamoswap error handling
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• Version 10.0.5:

  • tests/functional/test_aarch64_sbsaref_freebsd: Fix the URL of the ISO image
  • tests/functional/test_ppc_bamboo: Replace broken link with working assets
  • physmem: Destroy all CPU AddressSpaces on unrealize
  • memory: New AS helper to serialize destroy+free
  • include/system/memory.h: Clarify address_space_destroy() behaviour
  • migration: Fix state transition in postcopy_start() error handling
  • target/riscv: rvv: Modify minimum VLEN according to enabled vector extensions
  • target/riscv: rvv: Replace checking V by checking Zve32x
  • target/riscv: Fix endianness swap on compressed instructions
  • hw/riscv/riscv-iommu: Fixup PDT Nested Walk
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).

• [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).
• block/curl: fix curl internal handles handling (bsc#1252768).

This update for qemu fixes the following issues:

• CVE-2024-6505: qemu-kvm: virtio-net: Fixed queue index out-of-bounds access in software RSS (bsc#1227397)
• CVE-2025-12464: net: pad packets to minimum length in qemu_receive_packet() (bsc#1253002)
• CVE-2025-11234: qemu-kvm: Fixed use-after-free in websocket handshake code leading to denial of service (bsc#1250984)

Other fixes:

• Fixed *-virtio-gpu-pci dependency on ARM (bsc#1254286)
• block/curl: Fixed curl internal handles handling (bsc#1252768)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too.
• [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).
• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).
• block/curl: fix curl internal handles handling (bsc#1252768).
• [openSUSE][RPM] spec: qemu-vgabios is required on ppc (bsc#1230042).

This update for qemu fixes the following issues:

• CVE-2025-11234: Fixed use-after-free in websocket handshake code can lead to denial of service (bsc#1250984).

This update for qemu fixes the following issues:

• CVE-2025-11234: Fixed use-after-free in websocket handshake code can lead to denial of service (bsc#1250984).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).
• block/curl: fix curl internal handles handling (bsc#1252768).

This update for qemu fixes the following issues:

Update to version 8.2.10.

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too.

• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).

• block/curl: fix curl internal handles handling (bsc#1252768).

• [openSUSE][RPM]: spec: qemu-vgabios is required on ppc (bsc#1230042).

• [roms] seabios: include "pciinit: don't misalign large BARs" (bsc#1246566).

• [openSUSE][RPM] spec: Require ipxe and virtio-gpu packages for more arch-es (bsc#1240157).

• [openSUSE][RPM]: disable LTO for userspace emulation on 15.6 (bsc#1243013).

• Version 8.2.10 changes:

  • Full changelog: https://lore.kernel.org/qemu-devel/[email protected]/
  • Some backports:
    • hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
    • target/ppc: Fix e200 duplicate SPRs
    • linux-user/riscv: Fix handling of cpu mask in riscv_hwprobe syscall
    • docs/about/emulation: Fix broken link
    • vdpa: Allow vDPA to work on big-endian machine
    • vdpa: Fix endian bugs in shadow virtqueue
    • target/loongarch: Fix vldi inst
    • target/arm: Simplify pstate_sm check in sve_access_check
    • target/arm: Make DisasContext.{fp, sve}_access_checked tristate
    • util/cacheflush: Make first DSB unconditional on aarch64
    • ui/cocoa: Temporarily ignore annoying deprecated declaration warnings
    • docs: Rename default-configs to configs
    • block: Zero block driver state before reopening
    • hw/xen/hvm: Fix Aarch64 typo
    • hw/net/smc91c111: Don't allow data register access to overrun buffer
    • hw/net/smc91c111: Sanitize packet length on tx
    • hw/net/smc91c111: Sanitize packet numbers
    • hw/net/smc91c111: Ignore attempt to pop from empty RX fifo
    • ppc/pnv/occ: Fix common area sensor offsets
    • net: move backend cleanup to NIC cleanup
    • net: parameterize the removing client from nc list
    • util/qemu-timer.c: Don't warp timer from timerlist_rearm()
    • target/arm: Correct STRD atomicity
    • target/arm: Correct LDRD atomicity and fault behaviour

This update for qemu fixes the following issues:

• CVE-2023-1544: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read() (bsc#1209554).
• CVE-2025-11234: qemu-kvm: use-after-free in websocket handshake code can lead to denial of service (bsc#1250984).
• CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing specially crafted VMDK files (bsc#1258509).

It was discovered that the UHCI controller implementation of QEMU could be brought into an invalid state. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2024-8354)

It was discovered that QEMU incorrectly handled memory during certain VNC operations. An remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-11234)

It was discovered that the e1000 network device implementation of QEMU could be made to write out of bounds. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-12464)

It was discovered that the virtio-crypto device implementation of QEMU did not limit the length of a certain path input. An attacker inside the guest could possibly use this issue to cause QEMU to consume large amount of memory, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-14876)

It was discovered that the KVM Xen guest support of QEMU could be made to read out of bounds. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-0665)