{"id":"CVE-2024-26328","aliases":["AZL-61710","BELL-CVE-2024-26328","DEBIAN-CVE-2024-26328","EUVD-2024-23597","GHSA-5355-6wp2-29w4","MGASA-2024-0387","SUSE-SU-2024:1103-1","SUSE-SU-2025:20011-1","UBUNTU-CVE-2024-26328","USN-6977-1","openSUSE-SU-2024:13876-1"],"status":"published","title":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not...","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.","severity":{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0029,"percentile":0.21748,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2024-02-19T00:00:00Z","modified":"2026-11-02T12:01:03Z","fixes":[{"ecosystem":"Azure Linux:3","package":"qemu","fixed_in":["8.2.0-16"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"qemu","fixed_in":["9.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"qemu","fixed_in":["9.0.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:7.2+dfsg-7+deb12u6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:8.2.3+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:8.2.3+ds-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"qemu","fixed_in":["1:8.2.2+ds-0ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-16"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0-r4"},{"fixed":"9.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.2-r0"},{"fixed":"9.0.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2+dfsg-7+deb12u6"}]}],"versions":["1:7.2+dfsg-7","1:7.2+dfsg-7+deb12u1","1:7.2+dfsg-7+deb12u2","1:7.2+dfsg-7+deb12u2~bpo11+1","1:7.2+dfsg-7+deb12u3","1:7.2+dfsg-7+deb12u4","1:7.2+dfsg-7+deb12u5"]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.3+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.3+ds-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.15-1.mga9"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.5-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.2"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.2"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.2-2.1"}]}],"bundled":4}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://lore.kernel.org/all/20240213055345-mutt-send-email-mst%40kernel.org/","tags":["x_transferred","Broken Link","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240419-0010/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26328","tags":["web","advisory"]},{"url":"https://lore.kernel.org/all/20240213055345-mutt-send-email-mst%40kernel.org","tags":["report"]},{"url":"https://security.netapp.com/advisory/ntap-20240419-0010"},{"url":"https://github.com/advisories/GHSA-5355-6wp2-29w4"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-26328","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-55","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26328.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-26328","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0387.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33074","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ES5DXAAMYUC767MUW4BPRP6ZPDL6SUW6/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-April/035064.html","tags":["web"]},{"url":"https://lwn.net/Articles/971720/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-August/036644.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/HL7L7OSCUZ44UAQCOB6IUOFBWKV6ECP2/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241103-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205316","tags":["report"]},{"url":"https://bugzilla.suse.com/1209554","tags":["report"]},{"url":"https://bugzilla.suse.com/1218484","tags":["report"]},{"url":"https://bugzilla.suse.com/1220062","tags":["report"]},{"url":"https://bugzilla.suse.com/1220065","tags":["report"]},{"url":"https://bugzilla.suse.com/1220134","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26328","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520011-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1084909","tags":["report"]},{"url":"https://bugzilla.suse.com/1220310","tags":["report"]},{"url":"https://bugzilla.suse.com/1222218","tags":["report"]},{"url":"https://bugzilla.suse.com/1222841","tags":["report"]},{"url":"https://bugzilla.suse.com/1222843","tags":["report"]},{"url":"https://bugzilla.suse.com/1222845","tags":["report"]},{"url":"https://bugzilla.suse.com/1224179","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3567","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-26328","tags":["report"]},{"url":"https://lists.nongnu.org/archive/html/qemu-devel/2024-02/msg03386.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26328","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6977-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-26327","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-26328","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.","status":"published","published":"2024-02-19T00:00:00Z","modified":"2024-11-06T14:39:09.161Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:33:59.512321Z"}],"euvd":[{"id":"EUVD-2024-23597","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.","status":"published","published":"2024-02-19T00:00:00Z","modified":"2024-11-06T14:39:09Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:05:10.508802Z"}],"ghsa":[{"id":"GHSA-5355-6wp2-29w4","title":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not...","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.","status":"published","published":"2024-02-19T06:30:33Z","modified":"2025-05-07T12:30:34Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:02:10.218491Z"}],"nvd":[{"id":"CVE-2024-26328","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.","status":"published","published":"2024-02-19T05:15:26.263Z","modified":"2026-06-17T07:17:37.05Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:09:37.655131Z"}],"osv":[{"id":"AZL-61710","title":"CVE-2024-26328 affecting package qemu for versions less than 8.2.0-16","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.","status":"published","published":"2024-02-19T05:15:26Z","modified":"2026-04-21T04:49:18.667187Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"BELL-CVE-2024-26328","status":"published","published":"2024-02-20T05:56:11.242201Z","modified":"2026-01-26T09:36:01.202596Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2024-26328","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.","status":"published","published":"2024-02-19T00:00:00Z","modified":"2026-10-28T02:31:00.836871073Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:39.244433Z"},{"id":"DEBIAN-CVE-2024-26328","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.","status":"published","published":"2024-02-19T05:15:26.263Z","modified":"2026-11-02T12:01:03.890206092Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"UBUNTU-CVE-2024-26328","description":"An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.","status":"published","published":"2024-02-19T05:15:00Z","modified":"2026-02-04T03:05:52.201973Z","cvss":[{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:44.862765Z"},{"id":"MGASA-2024-0387","title":"Updated qemu packages fix security vulnerabilities","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA\ndevice. This flaw allows a crafted guest driver to allocate and\ninitialize a huge number of page tables to be used as a ring of\ndescriptors for CQ and async events, potentially leading to an\nout-of-bounds read and crash of QEMU. (CVE-2023-1544)\nA DMA reentrancy issue leading to a use-after-free error was found in\nthe e1000e NIC emulation code in QEMU. This issue could allow a\nprivileged guest user to crash the QEMU process on the host, resulting\nin a denial of service. (CVE-2023-3019)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. A wrong exit condition may lead to an infinite\nloop when inflating an attacker controlled zlib buffer in the\n`inflate_buffer` function. This could allow a remote authenticated\nclient who is able to send a clipboard to the VNC server to trigger a\ndenial of service. (CVE-2023-3255)\nA bug in QEMU could cause a guest I/O operation otherwise addressed to\nan arbitrary disk offset to be targeted to offset 0 instead (potentially\noverwriting the VM's boot code). This could be used, for example, by L2\nguests with a virtual disk (vdiskL2) stored on a virtual disk of an L1\n(vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1,\npotentially gaining control of L1 at its next reboot. (CVE-2023-5088)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. The qemu_clipboard_request() function can be\nreached before vnc_server_cut_text_caps() was called and had the chance\nto initialize the clipboard peer, leading to a NULL pointer dereference.\nThis could allow a malicious authenticated VNC client to crash QEMU and\ntrigger a denial of service. (CVE-2023-6683)\nA stack based buffer overflow was found in the virtio-net device of\nQEMU. This issue occurs when flushing TX in the virtio_net_flush_tx\nfunction if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1\nand VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious\nuser to overwrite local variables allocated on the stack. Specifically,\nthe `out_sg` variable could be used to read a part of process memory and\nsend it to the wire, causing an information leak. (CVE-2023-6693)\nQEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset\nin hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not\nprevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest\nimmediately. (CVE-2023-42467)\nQEMU before 8.2.0 has an integer underflow, and resultant buffer\noverflow, via a TI command when an expected non-DMA transfer length is\nless than the length of the available FIFO data. This occurs in\nesp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.\n(CVE-2024-24474)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs\ngreater than TotalVFs, leading to a buffer overflow in VF\nimplementations. (CVE-2024-26327)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus\ninteraction with hw/nvme/ctrl.c is mishandled. (CVE-2024-26328)\nA double free vulnerability was found in QEMU virtio devices\n(virtio-gpu, virtio-serial-bus, virtio-crypto), where the\nmem_reentrancy_guard flag insufficiently protects against DMA reentrancy\nissues. This issue could allow a malicious privileged guest user to\ncrash the QEMU process on the host, resulting in a denial of service or\nallow arbitrary code execution within the context of the QEMU process on\nthe host. (CVE-2024-3446)\nA heap-based buffer overflow was found in the SDHCI device emulation of\nQEMU. The bug is triggered when both `s-\u003edata_count` and the size of\n`s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A\nmalicious guest could use this flaw to crash the QEMU process on the\nhost, resulting in a denial of service condition. (CVE-2024-3447)\nA flaw was found in the QEMU disk image utility (qemu-img) 'info'\ncommand. A specially crafted image file containing a `json:{}` value\ndescribing block devices in QMP could cause the qemu-img process on the\nhost to consume large amounts of memory or CPU time, leading to denial\nof service or read/write to an existing external file. (CVE-2024-4467)\nA flaw was found in the QEMU NBD Server. This vulnerability allows a\ndenial of service (DoS) attack via improper synchronization during\nsocket closure when a client keeps a socket open as the server is taken\noffline. (CVE-2024-7409)\nA flaw was found in QEMU. An assertion failure was present in the\nusb_ep_get() function in hw/net/core.c when trying to get the USB\nendpoint from a USB device. This flaw may allow a malicious unprivileged\nguest user to crash the QEMU process on the host and cause a denial of\nservice condition. (CVE-2024-8354)\nA flaw was found in QEMU, in the virtio-scsi, virtio-blk, and\nvirtio-crypto devices. The size for virtqueue_push as set in\nvirtio_scsi_complete_req / virtio_blk_req_complete /\nvirito_crypto_req_complete could be larger than the true size of the\ndata which has been sent to guest. Once virtqueue_push() finally calls\ndma_memory_unmap to ummap the in_iov, it may call the\naddress_space_write function to write back the data. Some uninitialized\ndata may exist in the bounce.buffer, leading to an information leak.\n(CVE-2024-8612)\n","status":"published","published":"2024-12-04T16:58:15Z","modified":"2026-04-16T04:44:09.257202401Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13876-1","title":"qemu-8.2.2-2.1 on GA media","description":"These are all security issues fixed in the qemu-8.2.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:29:45.217355Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:1103-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-26327: Fixed buffer overflow via invalid SR/IOV NumVFs value (bsc#1220062).\n- CVE-2024-24474: Fixed integer overflow results in buffer overflow via SCSI command (bsc#1220134).\n- CVE-2023-6693: Fixed stack buffer overflow in virtio_net_flush_tx() (bsc#1218484).\n- CVE-2023-1544: Fixed out-of-bounds read in pvrdma_ring_next_elem_read() (bsc#1209554).\n- CVE-2024-26328: Fixed invalid NumVFs value handled in NVME SR/IOV implementation (bsc#1220065).\n\nThe following non-security bug was fixed:\n\n- Removing in-use mediated device should fail with error message instead of hang (bsc#1205316).\n","status":"published","published":"2024-04-03T12:11:07Z","modified":"2026-02-04T04:40:44.89986Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2025:20011-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- Update to version 8.2.5:\n  * target/loongarch: fix a wrong print in cpu dump\n  * ui/sdl2: Allow host to power down screen\n  * target/i386: fix SSE and SSE2 feature check\n  * target/i386: fix xsave.flat from kvm-unit-tests\n  * disas/riscv: Decode all of the pmpcfg and pmpaddr CSRs\n  * target/riscv/kvm.c: Fix the hart bit setting of AIA\n  * target/riscv: rvzicbo: Fixup CBO extension register calculation\n  * target/riscv: do not set mtval2 for non guest-page faults\n  * target/riscv: prioritize pmp errors in raise_mmu_exception()\n  * target/riscv: rvv: Remove redudant SEW checking for vector fp narrow/widen instructions\n  * target/riscv: rvv: Check single width operator for vfncvt.rod.f.f.w\n  * target/riscv: rvv: Check single width operator for vector fp widen instructions\n  * target/riscv: rvv: Fix Zvfhmin checking for vfwcvt.f.f.v and vfncvt.f.f.w instructions\n  * target/riscv/cpu.c: fix Zvkb extension config\n  * target/riscv: Fix the element agnostic function problem\n  * target/riscv/kvm: tolerate KVM disable ext errors\n  * hw/intc/riscv_aplic: APLICs should add child earlier than realize\n  * iotests: test NBD+TLS+iothread\n  * qio: Inherit follow_coroutine_ctx across TLS\n  * target/arm: Disable SVE extensions when SVE is disabled\n  * hw/intc/arm_gic: Fix handling of NS view of GICC_APR\u003cn\u003e\n  * hvf: arm: Fix encodings for ID_AA64PFR1_EL1 and debug System registers\n  * gitlab: use 'setarch -R' to workaround tsan bug\n  * gitlab: use $MAKE instead of 'make'\n  * dockerfiles: add 'MAKE' env variable to remaining containers\n  * gitlab: Update msys2-64bit runner tags\n  * target/i386: no single-step exception after MOV or POP SS\n\n- Update to version 8.2.4.\n  * target/sh4: Fix SUBV opcode\n  * target/sh4: Fix ADDV opcode\n  * hw/arm/npcm7xx: Store derivative OTP fuse key in little endian\n  * hw/dmax/xlnx_dpdma: fix handling of address_extension descriptor fields\n  * hw/ufs: Fix buffer overflow bug\n  * tests/avocado: update sunxi kernel from armbian to 6.6.16\n  * target/loongarch/cpu.c: typo fix: expection\n  * backends/cryptodev-builtin: Fix local_error leaks\n  * nbd/server: Mark negotiation functions as coroutine_fn\n  * nbd/server: do not poll within a coroutine context\n  * linux-user: do_setsockopt: fix SOL_ALG.ALG_SET_KEY\n  * target/riscv/kvm: change timer regs size to u64\n  * target/riscv/kvm: change KVM_REG_RISCV_FP_D to u64\n  * target/riscv/kvm: change KVM_REG_RISCV_FP_F to u32\n\n- Update to version 8.2.3.\n  * Update version for 8.2.3 release\n  * ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS.\n  * ppc/spapr: Introduce SPAPR_IRQ_NR_IPIS to refer IRQ range for CPU IPIs.\n  * hw/pci-host/ppc440_pcix: Do not expose a bridge device on PCI bus\n  * hw/isa/vt82c686: Keep track of PIRQ/PINT pins separately\n  * virtio-pci: fix use of a released vector\n  * linux-user/x86_64: Handle the vsyscall page in open_self_maps_{2,4}\n  * hw/audio/virtio-snd: Remove unused assignment\n  * hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()\n  * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set\n  * hw/net/lan9118: Fix overflow in MIL TX FIFO\n  * hw/net/lan9118: Replace magic '2048' value by MIL_TXFIFO_SIZE definition\n  * backends/cryptodev: Do not abort for invalid session ID\n  * hw/misc/applesmc: Fix memory leak in reset() handler\n  * hw/block/nand: Fix out-of-bound access in NAND block buffer\n  * hw/block/nand: Have blk_load() take unsigned offset and return boolean\n  * hw/block/nand: Factor nand_load_iolen() method out\n  * qemu-options: Fix CXL Fixed Memory Window interleave-granularity typo\n  * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs\n  * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs\n  * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs\n  * mirror: Don't call job_pause_point() under graph lock (bsc#1224179)\n\n- Backports and bugfixes:\n  * hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum() (bsc#1222841, CVE-2024-3567)\n  * hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446)\n  * hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446)\n  * hw/display/virtio-gpu: Protect from DMA re-entrancy bugs (bsc#1222843, CVE-2024-3446)\n  * hw/virtio: Introduce virtio_bh_new_guarded() helper (bsc#1222843, CVE-2024-3446)\n  * hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (bsc#1222845, CVE-2024-3447)\n  * hw/nvme: Use pcie_sriov_num_vfs() (bsc#1220065, CVE-2024-26328)\n\n- Update to version 8.2.2\n  * chardev/char-socket: Fix TLS io channels sending too much data to the backend\n  * tests/unit/test-util-sockets: Remove temporary file after test\n  * hw/usb/bus.c: PCAP adding 0xA in Windows version\n  * hw/intc/Kconfig: Fix GIC settings when using \"--without-default-devices\"\n  * gitlab: force allow use of pip in Cirrus jobs\n  * tests/vm: avoid re-building the VM images all the time\n  * tests/vm: update openbsd image to 7.4\n  * target/i386: leave the A20 bit set in the final NPT walk\n  * target/i386: remove unnecessary/wrong application of the A20 mask\n  * target/i386: Fix physical address truncation\n  * target/i386: check validity of VMCB addresses\n  * target/i386: mask high bits of CR3 in 32-bit mode\n  * pl031: Update last RTCLR value on write in case it's read back\n  * hw/nvme: fix invalid endian conversion\n  * update edk2 binaries to edk2-stable202402\n  * update edk2 submodule to edk2-stable202402\n  * target/ppc: Fix crash on machine check caused by ifetch\n  * target/ppc: Fix lxv/stxv MSR facility check\n  * .gitlab-ci.d/windows.yml: Drop msys2-32bit job\n  * system/vl: Update description for input grab key\n  * docs/system: Update description for input grab key\n  * hw/hppa/Kconfig: Fix building with \"configure --without-default-devices\"\n  * tests/qtest: Depend on dbus_display1_dep\n  * meson: Explicitly specify dbus-display1.h dependency\n  * audio: Depend on dbus_display1_dep\n  * ui/console: Fix console resize with placeholder surface\n  * ui/clipboard: add asserts for update and request\n  * ui/clipboard: mark type as not available when there is no data\n  * ui: reject extended clipboard message if not activated\n  * target/i386: Generate an illegal opcode exception on cmp instructions with lock prefix\n  * i386/cpuid: Move leaf 7 to correct group\n  * i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F\n  * i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs\n  * i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available\n  * .gitlab-ci/windows.yml: Don't install libusb or spice packages on 32-bit\n  * iotests: Make 144 deterministic again\n  * target/arm: Don't get MDCR_EL2 in pmu_counter_enabled() before checking ARM_FEATURE_PMU\n  * target/arm: Fix SVE/SME gross MTE suppression checks\n  * target/arm: Handle mte in do_ldrq, do_ldro\n- Address bsc#1220310. Backported upstream commits:\n  * ppc/spapr: Initialize max_cpus limit to SPAPR_IRQ_NR_IPIS\n  * ppc/spapr: Introduce SPAPR_IRQ_NR_IPIS to refer IRQ range for CPU IPIs.\n","status":"published","published":"2025-02-03T08:47:27Z","modified":"2026-03-23T04:47:06.565245Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-6977-1","title":"qemu vulnerabilities","description":"It was discovered that QEMU did not properly handle certain memory\noperations, which could result in a buffer overflow. An attacker could\npotentially use this issue to cause a denial of service. (CVE-2024-26327)\n\nIt was discovered that QEMU did not properly handle certain memory\noperations, which could result in an out-of-bounds memory access. An\nattacker could potentially use this issue to cause a denial of service.\n(CVE-2024-26328)\n","status":"published","published":"2024-08-22T04:04:17Z","modified":"2026-02-10T04:45:04Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}