CVE-2025-14876

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.(CVE-2025-14876)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.(CVE-2025-14876)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.(CVE-2025-14876)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.(CVE-2025-14876)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.(CVE-2025-14876)

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.

These are all security issues fixed in the qemu-10.2.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

• Update to version 10.0.8
• CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)
• CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)

This update for qemu fixes the following issues:

• CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).
• CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).

This update for qemu fixes the following issues:

Security issue:

• CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).

Non security issues:

• • hw/virtio: Also include md stubs in case CONFIG_VIRTIO_PCI is not set (jsc#PED-14271).
• • s390x/pv: prepare for memory devices (jsc#PED-14271).
• • s390x/s390-skeys: prepare for memory devices (jsc#PED-14271).
• • s390x/s390-stattrib-kvm: prepare for memory devices and sparse memory layouts (jsc#PED-14271).
• • s390x/s390-virtio-ccw: prepare for memory devices (jsc#PED-14271).
• • s390x/virtio-ccw: add support for virtio based memory devices (jsc#PED-14271).
• • s390x: remember the maximum page size (jsc#PED-14271).
• • s390x: virtio-mem support (jsc#PED-14271).

This update for qemu fixes the following issue:

• CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).

This update for qemu fixes the following issues:

• CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)
• CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)

This update for qemu fixes the following issues:

• Update to version 10.0.8
• CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)
• CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)

This update for qemu fixes the following issues:

• CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)
• CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)

This update for qemu fixes the following issues

• CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).
• CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).
• CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing specially crafted VMDK files (bsc#1258509).
• CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to insufficient checks in virtio_snd_pcm_in_cb (bsc#1259080).
• CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded memory allocation and host denial-of-service (bsc#1259079).
• CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write (bsc#1262089).

This update for qemu fixes the following issues

• CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).
• CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).
• CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing specially crafted VMDK files (bsc#1258509).
• CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to insufficient checks in virtio_snd_pcm_in_cb (bsc#1259080).
• CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded memory allocation and host denial-of-service (bsc#1259079).
• CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write (bsc#1262089).

This update for qemu fixes the following issues:

• CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).
• CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).
• CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing specially crafted VMDK files (bsc#1258509).
• CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to insufficient checks in virtio_snd_pcm_in_cb (bsc#1259080).
• CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded memory allocation and host denial-of-service (bsc#1259079).
• CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write (bsc#1262089).

It was discovered that the UHCI controller implementation of QEMU could be brought into an invalid state. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2024-8354)

It was discovered that QEMU incorrectly handled memory during certain VNC operations. An remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-11234)

It was discovered that the e1000 network device implementation of QEMU could be made to write out of bounds. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-12464)

It was discovered that the virtio-crypto device implementation of QEMU did not limit the length of a certain path input. An attacker inside the guest could possibly use this issue to cause QEMU to consume large amount of memory, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-14876)

It was discovered that the KVM Xen guest support of QEMU could be made to read out of bounds. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-0665)