CVE-2025-12464

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

An "off by one" bug has been discovered in QEMU's KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

An "off by one" bug has been discovered in QEMU's KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

An "off by one" bug has been discovered in QEMU's KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.

These are all security issues fixed in the qemu-10.1.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

Update to version 10.0.7.

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• Version 10.0.7:

  • kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
  • docs/devel: Update URL for make-pullreq script
  • target/arm: Fix assert on BRA.
  • hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
  • hw/core/machine: Provide a description for aux-ram-share property
  • hw/pci: Make msix_init take a uint32_t for nentries
  • block/io_uring: avoid potentially getting stuck after resubmit at the end of ioq_submit()
  • block-backend: Fix race when resuming queued requests
  • ui/vnc: Fix qemu abort when query vnc info
  • chardev/char-pty: Do not ignore chr_write() failures
  • hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
  • hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
  • hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure
  • migration: Fix transition to COLO state from precopy
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• Version 10.0.6:

  • linux-user/microblaze: Fix little-endianness binary
  • target/hppa: correct size bit parity for fmpyadd
  • target/i386: user: do not set up a valid LDT on reset
  • async: access bottom half flags with qatomic_read
  • target/i386: fix x86_64 pushw op
  • i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit
  • i386/cpu: Prevent delivering SIPI during SMM in TCG mode
  • i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS
  • target/i386: Fix CR2 handling for non-canonical addresses
  • block/curl.c: Use explicit long constants in curl_easy_setopt calls
  • pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs
  • target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN2 and SEWd
  • target/riscv: Fix ssamoswap error handling
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• Version 10.0.5:

  • tests/functional/test_aarch64_sbsaref_freebsd: Fix the URL of the ISO image
  • tests/functional/test_ppc_bamboo: Replace broken link with working assets
  • physmem: Destroy all CPU AddressSpaces on unrealize
  • memory: New AS helper to serialize destroy+free
  • include/system/memory.h: Clarify address_space_destroy() behaviour
  • migration: Fix state transition in postcopy_start() error handling
  • target/riscv: rvv: Modify minimum VLEN according to enabled vector extensions
  • target/riscv: rvv: Replace checking V by checking Zve32x
  • target/riscv: Fix endianness swap on compressed instructions
  • hw/riscv/riscv-iommu: Fixup PDT Nested Walk
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).

• [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).

This update for qemu fixes the following issues:

Update to version 10.0.7.

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• Version 10.0.7:

  • kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
  • docs/devel: Update URL for make-pullreq script
  • target/arm: Fix assert on BRA.
  • hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
  • hw/core/machine: Provide a description for aux-ram-share property
  • hw/pci: Make msix_init take a uint32_t for nentries
  • block/io_uring: avoid potentially getting stuck after resubmit at the end of ioq_submit()
  • block-backend: Fix race when resuming queued requests
  • ui/vnc: Fix qemu abort when query vnc info
  • chardev/char-pty: Do not ignore chr_write() failures
  • hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
  • hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
  • hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure
  • migration: Fix transition to COLO state from precopy
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• Version 10.0.6:

  • linux-user/microblaze: Fix little-endianness binary
  • target/hppa: correct size bit parity for fmpyadd
  • target/i386: user: do not set up a valid LDT on reset
  • async: access bottom half flags with qatomic_read
  • target/i386: fix x86_64 pushw op
  • i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit
  • i386/cpu: Prevent delivering SIPI during SMM in TCG mode
  • i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS
  • target/i386: Fix CR2 handling for non-canonical addresses
  • block/curl.c: Use explicit long constants in curl_easy_setopt calls
  • pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs
  • target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN2 and SEWd
  • target/riscv: Fix ssamoswap error handling
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• Version 10.0.5:

  • tests/functional/test_aarch64_sbsaref_freebsd: Fix the URL of the ISO image
  • tests/functional/test_ppc_bamboo: Replace broken link with working assets
  • physmem: Destroy all CPU AddressSpaces on unrealize
  • memory: New AS helper to serialize destroy+free
  • include/system/memory.h: Clarify address_space_destroy() behaviour
  • migration: Fix state transition in postcopy_start() error handling
  • target/riscv: rvv: Modify minimum VLEN according to enabled vector extensions
  • target/riscv: rvv: Replace checking V by checking Zve32x
  • target/riscv: Fix endianness swap on compressed instructions
  • hw/riscv/riscv-iommu: Fixup PDT Nested Walk
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).

• [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).

This update for qemu fixes the following issues:

Update to version 10.0.7.

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• Version 10.0.7:

  • kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
  • docs/devel: Update URL for make-pullreq script
  • target/arm: Fix assert on BRA.
  • hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
  • hw/core/machine: Provide a description for aux-ram-share property
  • hw/pci: Make msix_init take a uint32_t for nentries
  • block/io_uring: avoid potentially getting stuck after resubmit at the end of ioq_submit()
  • block-backend: Fix race when resuming queued requests
  • ui/vnc: Fix qemu abort when query vnc info
  • chardev/char-pty: Do not ignore chr_write() failures
  • hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
  • hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
  • hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure
  • migration: Fix transition to COLO state from precopy
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• Version 10.0.6:

  • linux-user/microblaze: Fix little-endianness binary
  • target/hppa: correct size bit parity for fmpyadd
  • target/i386: user: do not set up a valid LDT on reset
  • async: access bottom half flags with qatomic_read
  • target/i386: fix x86_64 pushw op
  • i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit
  • i386/cpu: Prevent delivering SIPI during SMM in TCG mode
  • i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS
  • target/i386: Fix CR2 handling for non-canonical addresses
  • block/curl.c: Use explicit long constants in curl_easy_setopt calls
  • pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs
  • target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN2 and SEWd
  • target/riscv: Fix ssamoswap error handling
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• Version 10.0.5:

  • tests/functional/test_aarch64_sbsaref_freebsd: Fix the URL of the ISO image
  • tests/functional/test_ppc_bamboo: Replace broken link with working assets
  • physmem: Destroy all CPU AddressSpaces on unrealize
  • memory: New AS helper to serialize destroy+free
  • include/system/memory.h: Clarify address_space_destroy() behaviour
  • migration: Fix state transition in postcopy_start() error handling
  • target/riscv: rvv: Modify minimum VLEN according to enabled vector extensions
  • target/riscv: rvv: Replace checking V by checking Zve32x
  • target/riscv: Fix endianness swap on compressed instructions
  • hw/riscv/riscv-iommu: Fixup PDT Nested Walk
  • Full backport list: https://lore.kernel.org/qemu-devel/[email protected]/

• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).

• [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).
• block/curl: fix curl internal handles handling (bsc#1252768).

This update for qemu fixes the following issues:

• CVE-2024-6505: qemu-kvm: virtio-net: Fixed queue index out-of-bounds access in software RSS (bsc#1227397)
• CVE-2025-12464: net: pad packets to minimum length in qemu_receive_packet() (bsc#1253002)
• CVE-2025-11234: qemu-kvm: Fixed use-after-free in websocket handshake code leading to denial of service (bsc#1250984)

Other fixes:

• Fixed *-virtio-gpu-pci dependency on ARM (bsc#1254286)
• block/curl: Fixed curl internal handles handling (bsc#1252768)

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2023-1544: out-of-bounds read in VMWare's paravirtual RDMA device operations can be exploited through a malicious guest driver to crash the QEMU process on the host (bsc#1209554).
• CVE-2024-6505: heap-based buffer overflow in the virtio-net device operations can be exploited by a malicious privileged user to crash the QEMU process on the host (bsc#1227397).
• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).

Other updates and bugfixes:

• [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too.
• [openSUSE][RPM} spec: delete old specfile constructs.
• block/curl: fix curl internal handles handling (bsc#1252768).
• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too.
• [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).
• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).
• block/curl: fix curl internal handles handling (bsc#1252768).
• [openSUSE][RPM] spec: qemu-vgabios is required on ppc (bsc#1230042).

This update for qemu fixes the following issues:

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).
• block/curl: fix curl internal handles handling (bsc#1252768).

This update for qemu fixes the following issues:

Update to version 8.2.10.

Security issues fixed:

• CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious guest user to crash the QEMU process on the host (bsc#1253002).
• CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

Other updates and bugfixes:

• [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too.

• [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).

• block/curl: fix curl internal handles handling (bsc#1252768).

• [openSUSE][RPM]: spec: qemu-vgabios is required on ppc (bsc#1230042).

• [roms] seabios: include "pciinit: don't misalign large BARs" (bsc#1246566).

• [openSUSE][RPM] spec: Require ipxe and virtio-gpu packages for more arch-es (bsc#1240157).

• [openSUSE][RPM]: disable LTO for userspace emulation on 15.6 (bsc#1243013).

• Version 8.2.10 changes:

  • Full changelog: https://lore.kernel.org/qemu-devel/[email protected]/
  • Some backports:
    • hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
    • target/ppc: Fix e200 duplicate SPRs
    • linux-user/riscv: Fix handling of cpu mask in riscv_hwprobe syscall
    • docs/about/emulation: Fix broken link
    • vdpa: Allow vDPA to work on big-endian machine
    • vdpa: Fix endian bugs in shadow virtqueue
    • target/loongarch: Fix vldi inst
    • target/arm: Simplify pstate_sm check in sve_access_check
    • target/arm: Make DisasContext.{fp, sve}_access_checked tristate
    • util/cacheflush: Make first DSB unconditional on aarch64
    • ui/cocoa: Temporarily ignore annoying deprecated declaration warnings
    • docs: Rename default-configs to configs
    • block: Zero block driver state before reopening
    • hw/xen/hvm: Fix Aarch64 typo
    • hw/net/smc91c111: Don't allow data register access to overrun buffer
    • hw/net/smc91c111: Sanitize packet length on tx
    • hw/net/smc91c111: Sanitize packet numbers
    • hw/net/smc91c111: Ignore attempt to pop from empty RX fifo
    • ppc/pnv/occ: Fix common area sensor offsets
    • net: move backend cleanup to NIC cleanup
    • net: parameterize the removing client from nc list
    • util/qemu-timer.c: Don't warp timer from timerlist_rearm()
    • target/arm: Correct STRD atomicity
    • target/arm: Correct LDRD atomicity and fault behaviour

It was discovered that the UHCI controller implementation of QEMU could be brought into an invalid state. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2024-8354)

It was discovered that QEMU incorrectly handled memory during certain VNC operations. An remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-11234)

It was discovered that the e1000 network device implementation of QEMU could be made to write out of bounds. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-12464)

It was discovered that the virtio-crypto device implementation of QEMU did not limit the length of a certain path input. An attacker inside the guest could possibly use this issue to cause QEMU to consume large amount of memory, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-14876)

It was discovered that the KVM Xen guest support of QEMU could be made to read out of bounds. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-0665)