CVE-2026-3886
Updated qemu packages fix many security vulnerabilities
This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
OSV Score usedOESA-2026-2861
qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.
Security Fix(es):
A vulnerability, which was classified as critical, has been found in QEMU (Virtualization Software) (version unknown).Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Impacted is confidentiality, integrity, and availability.Upgrading eliminates this vulnerability.(CVE-2026-3886)
A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.(CVE-2026-48914)
- Record
OESA-2026-2861- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSV Score usedOESA-2026-2952
qemu security update
QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.
Security Fix(es):
A vulnerability, which was classified as critical, has been found in QEMU (Virtualization Software) (version unknown).Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Impacted is confidentiality, integrity, and availability.Upgrading eliminates this vulnerability.(CVE-2026-3886)
A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.(CVE-2026-48914)
- Record
OESA-2026-2952- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2026-0334 No score
Updated qemu packages fix many security vulnerabilities
This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4
- Record
MGASA-2026-0334- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21253-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Update to version 10.0.11.
Security issues fixed:
- CVE-2026-3886: integer overflow leading to privilege escalation due to lack of proper validation of user-supplied data in the virtio-gpu driver (bsc#1268061).
- CVE-2026-48914: heap buffer overflow due to improper size validation in virtio-blk SCSI request handling (bsc#1268794).
- CVE-2026-48004: heap use-after-free race condition due to missing rename lock in v9fs_co_readdir_many (bsc#1270133).
Other updates and bugfixes:
- Version 10.0.11:
- Full backport list here: https://lore.kernel.org/qemu-devel/[email protected]/
- Version 10.0.10:
- Full backport list here: https://lore.kernel.org/qemu-devel/[email protected]/
- ppc/spapr: Skip system reset for quiesced CPUs (bsc#1268279).
- i386/tdx: handle TDG.VP.VMCALL <GetQuote> (jsc#PED-9266).
- i386/tdx: handle TDG.VP.VMCALL <GetTdVmCallInfo> (jsc#PED-9266).
- update Linux headers to v6.16-rc3 (jsc#PED-9266).
- i386/cpu: Warn about why CPUID_EXT_PDCM is not available (jsc#PED-9266).
- i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[] check (jsc#PED-9266).
- [openSUSE] qemu-ga: fix service file against no-autostart (bsc#1199023).
- Record
openSUSE-SU-2026:21253-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22550-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Update to version 10.0.11.
Security issues fixed:
- CVE-2026-3886: integer overflow leading to privilege escalation due to lack of proper validation of user-supplied data in the virtio-gpu driver (bsc#1268061).
- CVE-2026-48914: heap buffer overflow due to improper size validation in virtio-blk SCSI request handling (bsc#1268794).
- CVE-2026-48004: heap use-after-free race condition due to missing rename lock in v9fs_co_readdir_many (bsc#1270133).
Other updates and bugfixes:
- Version 10.0.11:
- Full backport list here: https://lore.kernel.org/qemu-devel/[email protected]/
- Version 10.0.10:
- Full backport list here: https://lore.kernel.org/qemu-devel/[email protected]/
- ppc/spapr: Skip system reset for quiesced CPUs (bsc#1268279).
- i386/tdx: handle TDG.VP.VMCALL <GetQuote> (jsc#PED-9266).
- i386/tdx: handle TDG.VP.VMCALL <GetTdVmCallInfo> (jsc#PED-9266).
- update Linux headers to v6.16-rc3 (jsc#PED-9266).
- i386/cpu: Warn about why CPUID_EXT_PDCM is not available (jsc#PED-9266).
- i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[] check (jsc#PED-9266).
- [openSUSE] qemu-ga: fix service file against no-autostart (bsc#1199023).
- Record
SUSE-SU-2026:22550-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22576-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Update to version 10.0.11.
Security issues fixed:
- CVE-2026-3886: integer overflow leading to privilege escalation due to lack of proper validation of user-supplied data in the virtio-gpu driver (bsc#1268061).
- CVE-2026-48914: heap buffer overflow due to improper size validation in virtio-blk SCSI request handling (bsc#1268794).
- CVE-2026-48004: heap use-after-free race condition due to missing rename lock in v9fs_co_readdir_many (bsc#1270133).
Other updates and bugfixes:
- Version 10.0.11:
- Full backport list here: https://lore.kernel.org/qemu-devel/[email protected]/
- Version 10.0.10:
- Full backport list here: https://lore.kernel.org/qemu-devel/[email protected]/
- ppc/spapr: Skip system reset for quiesced CPUs (bsc#1268279).
- i386/tdx: handle TDG.VP.VMCALL <GetQuote> (jsc#PED-9266).
- i386/tdx: handle TDG.VP.VMCALL <GetTdVmCallInfo> (jsc#PED-9266).
- update Linux headers to v6.16-rc3 (jsc#PED-9266).
- i386/cpu: Warn about why CPUID_EXT_PDCM is not available (jsc#PED-9266).
- i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[] check (jsc#PED-9266).
- [openSUSE] qemu-ga: fix service file against no-autostart (bsc#1199023).
- Record
SUSE-SU-2026:22576-1- Updated
- 2026-11-02
Show 5 moreShow less
OSVSUSE-SU-2026:23351-1 No score
Security update for qemu
This update for qemu fixes the following issue:
- CVE-2026-3886: lack of proper validation of user-supplied data in the
virtio-gpudriver can lead to local privilege escalation via an integer overflow (bsc#1268061).
Other updates and bugfixes:
- Service: switch back to
tar_scm. - Bug fixes:
- target/s390x: Make container ids in
SysIB_15x1-based (bsc#1275490). - target/s390x: move
@deprecated-propstoCpuModelExpansionInfo(bsc#1273447). - target/s390x: filter deprecated properties based on model expansion type (bsc#1273447).
- target/s390x: flag
teandcteas deprecated (bsc#1273447). - target/s390x: report
deprecated-propsincpu-model-expansionreply (bsc#1273447).
- target/s390x: Make container ids in
- qemu-ga: fix service file against no-autostart (bsc#1199023).
- Record
SUSE-SU-2026:23351-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23362-1 No score
Security update for qemu
This update for qemu fixes the following issue:
- CVE-2026-3886: lack of proper validation of user-supplied data in the
virtio-gpudriver can lead to local privilege escalation via an integer overflow (bsc#1268061).
Other updates and bugfixes:
- Service: switch back to
tar_scm. - Bug fixes:
- target/s390x: Make container ids in
SysIB_15x1-based (bsc#1275490). - target/s390x: move
@deprecated-propstoCpuModelExpansionInfo(bsc#1273447). - target/s390x: filter deprecated properties based on model expansion type (bsc#1273447).
- target/s390x: flag
teandcteas deprecated (bsc#1273447). - target/s390x: report
deprecated-propsincpu-model-expansionreply (bsc#1273447).
- target/s390x: Make container ids in
- qemu-ga: fix service file against no-autostart (bsc#1199023).
- Record
SUSE-SU-2026:23362-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3038-1 No score
Security update for qemu
This update for qemu fixes the following issues
- CVE-2026-3886: QEMU calc_image_hostmem Integer Overflow Local Privilege Escalation Vulnerability (bsc#1268061).
- CVE-2026-48004: heap use-after-free race condition allows a DoS by an unprivileged guest user (bsc#1270133).
- CVE-2026-48914: qemu-kvm: Heap Buffer Overflow in virtio-blk SCSI Request Handling (bsc#1268794).
- Record
SUSE-SU-2026:3038-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3806-1 No score
Security update for qemu
This update for qemu fixes the following issue:
- CVE-2026-3886: QEMU calc_image_hostmem Integer Overflow Local Privilege Escalation Vulnerability (bsc#1268061).
Changes for qemu:
- Bug fixes:
- target/s390x: Make container ids in SysIB_15x 1-based (bsc#1275490)
- target/s390x: move @deprecated-props to CpuModelExpansion Info (bsc#1273447)
- target/s390x: filter deprecated properties based on model expansion type (bsc#1273447)
- target/s390x: flag te and cte as deprecated (bsc#1273447)
- target/s390x: report deprecated-props in cpu-model-expansion reply (bcs#1273447)
- Record
SUSE-SU-2026:3806-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-3886 No score
[virtio-gpu: fix overflow check when allocating 2d image]
- Record
UBUNTU-CVE-2026-3886- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuAlpaquita:25 |
10.0.0-r1 up to 10.0.12-r0 | 10.0.12-r0 |
qemuAlpaquita:stream |
8.0.2-r0 up to 11.0.0-r0 | 11.0.0-r0 |
qemuDebian:13 |
before 1:10.0.10+ds-0+deb13u1, plus listed versions 1:10.0.2+ds-21:10.0.2+ds-2+deb13u11:10.0.2+ds-2+deb13u1~bpo12+11:10.0.3+ds-0+deb13u11:10.0.3+ds-1 Show 7 moreShow less1:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-41:10.0.6+ds-0+deb13u11:10.0.6+ds-0+deb13u21:10.0.7+ds-0+deb13u11:10.0.8+ds-0+deb13u1 |
1:10.0.10+ds-0+deb13u1 |
qemuDebian:14 |
before 1:11.0.0+ds-1, plus listed versions 1:10.0.2+ds-21:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-4 Show 35 moreShow less1:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0~rc0+ds-11:11.0.0~rc0+ds-21:11.0.0~rc1+ds-11:11.0.0~rc1+ds-21:11.0.0~rc1+ds-31:11.0.0~rc2+ds-11:11.0.0~rc2+ds-21:11.0.0~rc3+ds-1 |
1:11.0.0+ds-1 |
qemuMageia:10 From an advisory covering 16 CVEs |
before 10.2.4-2.mga10 | 10.2.4-2.mga10 |
qemuopenEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 8.2.0-80.oe2403sp3 | 8.2.0-80.oe2403sp3 |
qemuopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 8.2.0-56.oe2403sp1 | 8.2.0-56.oe2403sp1 |
qemuSUSE:Linux Micro 6.2 From an advisory covering 3 CVEs |
before 10.0.11-160000.1.1 | 10.0.11-160000.1.1 |
qemuSUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs |
before 10.0.11-160000.1.1 | 10.0.11-160000.1.1 |
qemu-linux-userSUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs |
before 10.0.11-160000.1.1 | 10.0.11-160000.1.1 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qemuSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs |
before 10.0.11-160000.1.1 | 10.0.11-160000.1.1 |
qemu-linux-userSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs |
before 10.0.11-160000.1.1 | 10.0.11-160000.1.1 |
qemuSUSE:Linux Micro 6.1 |
before 8.2.10-slfo.1.1_6.1 | 8.2.10-slfo.1.1_6.1 |
qemuSUSE:Linux Micro 6.0 |
before 8.2.10-4.1 | 8.2.10-4.1 |
qemuSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 3 CVEs |
before 9.2.4-150700.3.23.1 | 9.2.4-150700.3.23.1 |
qemuSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 3 CVEs |
before 9.2.4-150700.3.23.1 | 9.2.4-150700.3.23.1 |
qemu-linux-userSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 3 CVEs |
before 9.2.4-150700.3.23.1 | 9.2.4-150700.3.23.1 |
qemuSUSE:Linux Enterprise Module for Server Applications 15 SP7 From an advisory covering 3 CVEs |
before 9.2.4-150700.3.23.1 | 9.2.4-150700.3.23.1 |
qemuSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 8.2.10-150600.3.52.1 | 8.2.10-150600.3.52.1 |
qemuSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 8.2.10-150600.3.52.1 | 8.2.10-150600.3.52.1 |
qemuUbuntu:24.04:LTS |
All versions, plus listed versions 1:8.0.4+dfsg-1ubuntu31:8.0.4+dfsg-1ubuntu41:8.0.4+dfsg-1ubuntu51:8.1.3+ds-1ubuntu21:8.2.1+ds-1ubuntu1 Show 19 moreShow less1:8.2.1+ds-1ubuntu81:8.2.1+ds-1ubuntu91:8.2.2+ds-0ubuntu11:8.2.2+ds-0ubuntu1.21:8.2.2+ds-0ubuntu1.41:8.2.2+ds-0ubuntu1.51:8.2.2+ds-0ubuntu1.61:8.2.2+ds-0ubuntu1.71:8.2.2+ds-0ubuntu1.81:8.2.2+ds-0ubuntu1.91:8.2.2+ds-0ubuntu1.101:8.2.2+ds-0ubuntu1.111:8.2.2+ds-0ubuntu1.121:8.2.2+ds-0ubuntu1.131:8.2.2+ds-0ubuntu1.141:8.2.2+ds-0ubuntu1.151:8.2.2+ds-0ubuntu1.161:8.2.2+ds-0ubuntu1.171:8.2.2+ds-0ubuntu1.18 |
None known |
qemuUbuntu:25.10 |
All versions, plus listed versions 1:9.2.1+ds-1ubuntu51:10.0.2+ds-1ubuntu11:10.0.2+ds-1ubuntu21:10.1.0+ds-1ubuntu11:10.1.0+ds-5ubuntu1 Show 7 moreShow less1:10.1.0+ds-5ubuntu21:10.1.0+ds-5ubuntu2.11:10.1.0+ds-5ubuntu2.21:10.1.0+ds-5ubuntu2.41:10.1.0+ds-5ubuntu2.51:10.1.0+ds-5ubuntu2.61:10.1.0+ds-5ubuntu2.7 |
None known |
qemuUbuntu:26.10 |
All versions, plus listed versions 1:10.2.1+ds-1ubuntu31:10.2.1+ds-1ubuntu61:11.0.3+ds-2ubuntu11:11.0.3+ds-2ubuntu2 |
None known |
qemu-hweUbuntu:26.10 |
All versions, plus listed versions 1:10.2.1+ds-1ubuntu41:10.2.1+ds-1ubuntu71:10.2.1+ds-1ubuntu81:11.0.3+ds-2ubuntu21:11.0.3+ds-2ubuntu4 |
None known |
qemuUbuntu:26.04:LTS |
All versions, plus listed versions 1:10.1.0+ds-5ubuntu21:10.1.0+ds-5ubuntu31:10.1.0+ds-5ubuntu41:10.1.0+ds-5ubuntu51:10.2.1+ds-1ubuntu1 Show 5 moreShow less1:10.2.1+ds-1ubuntu21:10.2.1+ds-1ubuntu31:10.2.1+ds-1ubuntu3.11:10.2.1+ds-1ubuntu3.21:10.2.1+ds-1ubuntu3.3 |
None known |
qemu-hweUbuntu:26.04:LTS |
All versions, plus listed versions 1:10.2.1+ds-1ubuntu21:10.2.1+ds-1ubuntu41:10.2.1+ds-1ubuntu4.21:10.2.1+ds-1ubuntu4.31:10.2.1+ds-1ubuntu4.4 |
None known |
qemuopenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 10.0.11-160000.1.1 | 10.0.11-160000.1.1 |
qemu-linux-useropenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 10.0.11-160000.1.1 | 10.0.11-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-3886 is a high vulnerability (CVSS 8.8) in qemu, published July 6, 2026. No source lists public exploit code. Fixed in qemu 10.0.12-r0.
References
docs.bell-sw.com/security/cves/CVE-2026-3886
security-tracker.debian.org/tracker/CVE-2026-3886
advisories.mageia.org/MGASA-2026-0334.html
bugs.mageia.org/show_bug.cgi?id=35989
lists.nongnu.org/archive/html/qemu-stable/2026-05/msg00654.html
Show 22 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2861
nvd.nist.gov/vuln/detail/CVE-2026-3886
suse.com/support/update/announcement/2026/suse-su-202622550-1
bugzilla.suse.com/1199023
ubuntu.com/security/CVE-2026-3886
cve.org/CVERecord?id=CVE-2026-3886