CVE-2026-0665

An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

An "off by one" bug has been discovered in QEMU's KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

An "off by one" bug has been discovered in QEMU's KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

An "off by one" bug has been discovered in QEMU's KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.

Security Fix(es):

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)

An "off by one" bug has been discovered in QEMU's KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)

An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.

These are all security issues fixed in the qemu-10.2.0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for qemu fixes the following issues:

• Update to version 10.0.8
• CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)
• CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)

This update for qemu fixes the following issues:

• CVE-2026-0665: Added PIRQ bounds check in xen_physdev_map_pirq to avoid an out-of-bounds heap. (bsc#1256484)

Other fixes:

• Fixed that QEMU migration fails if a qemu-vdagent channel is present in the VM (bsc#1257474)

This update for qemu fixes the following issues:

• CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).
• CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).

This update for qemu fixes the following issues:

• CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)
• CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)

This update for qemu fixes the following issues:

• Update to version 10.0.8
• CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)
• CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)

This update for qemu fixes the following issues:

• CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)
• CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)

This update for qemu fixes the following issues

• CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).
• CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).
• CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing specially crafted VMDK files (bsc#1258509).
• CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to insufficient checks in virtio_snd_pcm_in_cb (bsc#1259080).
• CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded memory allocation and host denial-of-service (bsc#1259079).
• CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write (bsc#1262089).

This update for qemu fixes the following issues

• CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).
• CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).
• CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing specially crafted VMDK files (bsc#1258509).
• CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to insufficient checks in virtio_snd_pcm_in_cb (bsc#1259080).
• CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded memory allocation and host denial-of-service (bsc#1259079).
• CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write (bsc#1262089).

This update for qemu fixes the following issues:

• CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).
• CVE-2026-0665: out-of-bounds heap access can lead to a denial of service or potential memory corruption (bsc#1256484).
• CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing specially crafted VMDK files (bsc#1258509).
• CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to insufficient checks in virtio_snd_pcm_in_cb (bsc#1259080).
• CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded memory allocation and host denial-of-service (bsc#1259079).
• CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write (bsc#1262089).

It was discovered that the UHCI controller implementation of QEMU could be brought into an invalid state. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2024-8354)

It was discovered that QEMU incorrectly handled memory during certain VNC operations. An remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-11234)

It was discovered that the e1000 network device implementation of QEMU could be made to write out of bounds. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-12464)

It was discovered that the virtio-crypto device implementation of QEMU did not limit the length of a certain path input. An attacker inside the guest could possibly use this issue to cause QEMU to consume large amount of memory, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-14876)

It was discovered that the KVM Xen guest support of QEMU could be made to read out of bounds. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-0665)