CVE-2026-41438
Updated qemu packages fix many security vulnerabilities
No scoreFix available
This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4
What each source reports
OSVMGASA-2026-0334 No score
Updated qemu packages fix many security vulnerabilities
This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4
- Record
MGASA-2026-0334- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-41438 No score
hw/uefi: add name_size check to uefi_vars_mm_lock_variable()
- Record
UBUNTU-CVE-2026-41438- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuAlpaquita:25 |
10.0.0-r1 up to 10.0.12-r0 | 10.0.12-r0 |
qemuAlpaquita:stream |
10.0.0-r0 up to 11.0.1-r0 | 11.0.1-r0 |
qemuDebian:13 |
before 1:10.0.10+ds-0+deb13u1, plus listed versions 1:10.0.2+ds-21:10.0.2+ds-2+deb13u11:10.0.2+ds-2+deb13u1~bpo12+11:10.0.3+ds-0+deb13u11:10.0.3+ds-1 Show 7 moreShow less1:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-41:10.0.6+ds-0+deb13u11:10.0.6+ds-0+deb13u21:10.0.7+ds-0+deb13u11:10.0.8+ds-0+deb13u1 |
1:10.0.10+ds-0+deb13u1 |
qemuDebian:14 |
before 1:11.0.1+ds-1, plus listed versions 1:10.0.2+ds-21:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-4 Show 37 moreShow less1:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0+ds-11:11.0.0+ds-21:11.0.0~rc0+ds-11:11.0.0~rc0+ds-21:11.0.0~rc1+ds-11:11.0.0~rc1+ds-21:11.0.0~rc1+ds-31:11.0.0~rc2+ds-11:11.0.0~rc2+ds-21:11.0.0~rc3+ds-1 |
1:11.0.1+ds-1 |
qemuMageia:10 From an advisory covering 16 CVEs |
before 10.2.4-2.mga10 | 10.2.4-2.mga10 |
qemuUbuntu:25.10 |
All versions, plus listed versions 1:9.2.1+ds-1ubuntu51:10.0.2+ds-1ubuntu11:10.0.2+ds-1ubuntu21:10.1.0+ds-1ubuntu11:10.1.0+ds-5ubuntu1 Show 7 moreShow less1:10.1.0+ds-5ubuntu21:10.1.0+ds-5ubuntu2.11:10.1.0+ds-5ubuntu2.21:10.1.0+ds-5ubuntu2.41:10.1.0+ds-5ubuntu2.51:10.1.0+ds-5ubuntu2.61:10.1.0+ds-5ubuntu2.7 |
None known |
qemuUbuntu:26.10 |
All versions, plus listed versions 1:10.2.1+ds-1ubuntu31:10.2.1+ds-1ubuntu61:11.0.3+ds-2ubuntu11:11.0.3+ds-2ubuntu2 |
None known |
qemu-hweUbuntu:26.10 |
All versions, plus listed versions 1:10.2.1+ds-1ubuntu41:10.2.1+ds-1ubuntu71:10.2.1+ds-1ubuntu81:11.0.3+ds-2ubuntu21:11.0.3+ds-2ubuntu4 |
None known |
qemuUbuntu:26.04:LTS |
All versions, plus listed versions 1:10.1.0+ds-5ubuntu21:10.1.0+ds-5ubuntu31:10.1.0+ds-5ubuntu41:10.1.0+ds-5ubuntu51:10.2.1+ds-1ubuntu1 Show 5 moreShow less1:10.2.1+ds-1ubuntu21:10.2.1+ds-1ubuntu31:10.2.1+ds-1ubuntu3.11:10.2.1+ds-1ubuntu3.21:10.2.1+ds-1ubuntu3.3 |
None known |
qemu-hweUbuntu:26.04:LTS |
All versions, plus listed versions 1:10.2.1+ds-1ubuntu21:10.2.1+ds-1ubuntu41:10.2.1+ds-1ubuntu4.21:10.2.1+ds-1ubuntu4.31:10.2.1+ds-1ubuntu4.4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41438 is a vulnerability with no CVSS score yet in qemu, published June 1, 2026. No source lists public exploit code. Fixed in qemu 10.0.12-r0.
References
docs.bell-sw.com/security/cves/CVE-2026-41438
security-tracker.debian.org/tracker/CVE-2026-41438
advisories.mageia.org/MGASA-2026-0334.html
bugs.mageia.org/show_bug.cgi?id=35989
lists.nongnu.org/archive/html/qemu-stable/2026-05/msg00654.html
ubuntu.com/security/CVE-2026-41438
cve.org/CVERecord?id=CVE-2026-41438