{"id":"CVE-2025-12464","aliases":["AZL-69631","BELL-CVE-2025-12464","DEBIAN-CVE-2025-12464","EUVD-2025-37403","GHSA-59fq-gggw-pqjr","OESA-2026-1351","OESA-2026-1353","OESA-2026-1354","OESA-2026-1355","OESA-2026-1848","SUSE-SU-2025:21230-1","SUSE-SU-2025:21233-1","SUSE-SU-2026:0022-1","SUSE-SU-2026:0039-1","SUSE-SU-2026:0043-1","SUSE-SU-2026:0288-1","SUSE-SU-2026:20008-1","SUSE-SU-2026:20038-1","UBUNTU-CVE-2025-12464","USN-8073-1","openSUSE-SU-2025:15821-1","openSUSE-SU-2025:20171-1"],"status":"published","title":"Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode","description":"A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00181,"percentile":0.0767,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2025-10-31T21:15:48Z","modified":"2026-11-05T21:15:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"qemu","fixed_in":["8.2.0-25"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"qemu","fixed_in":["10.0.9-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"qemu","fixed_in":["10.2.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:10.0.7+ds-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:10.1.3+ds-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"qemu","fixed_in":["1:8.2.2+ds-0ubuntu1.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"qemu","fixed_in":["1:10.1.0+ds-5ubuntu2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-25"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r1"},{"fixed":"10.0.9-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.2-r0"},{"fixed":"10.2.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.7+ds-0+deb13u1"}]}],"versions":["1:10.0.2+ds-2","1:10.0.2+ds-2+deb13u1","1:10.0.2+ds-2+deb13u1~bpo12+1","1:10.0.3+ds-0+deb13u1","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.0.6+ds-0+deb13u1","1:10.0.6+ds-0+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.3+ds-1"}]}],"versions":["1:10.0.2+ds-2","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.1.0+ds-1","1:10.1.0+ds-2","1:10.1.0+ds-3","1:10.1.0+ds-4","1:10.1.0+ds-5","1:10.1.0~rc0+ds-1","1:10.1.0~rc0+ds-2","1:10.1.0~rc0+ds-3","1:10.1.0~rc0+ds-4","1:10.1.0~rc1+ds-1","1:10.1.0~rc1+ds-1a","1:10.1.0~rc1+ds-1b","1:10.1.0~rc1+ds-2","1:10.1.0~rc1+ds-3","1:10.1.0~rc2+ds-1","1:10.1.0~rc3+ds-1","1:10.1.0~rc3+ds-2","1:10.1.1+ds-1","1:10.1.2+ds-1","1:10.1.2+ds-2","1:10.1.2+ds-3"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-54.oe2403sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-112.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-53.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-53.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-72.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.7-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.7-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.7-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.7-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.7-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.36.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.46.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-slfo.1.1_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.13"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9","1:8.2.2+ds-0ubuntu1.10","1:8.2.2+ds-0ubuntu1.11","1:8.2.2+ds-0ubuntu1.12"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0+ds-5ubuntu2.4"}]}],"versions":["1:9.2.1+ds-1ubuntu5","1:10.0.2+ds-1ubuntu1","1:10.0.2+ds-1ubuntu2","1:10.1.0+ds-1ubuntu1","1:10.1.0+ds-5ubuntu1","1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu2.1","1:10.1.0+ds-5ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.28"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10","1:6.2+dfsg-2ubuntu6.11","1:6.2+dfsg-2ubuntu6.12","1:6.2+dfsg-2ubuntu6.13","1:6.2+dfsg-2ubuntu6.14","1:6.2+dfsg-2ubuntu6.15","1:6.2+dfsg-2ubuntu6.16","1:6.2+dfsg-2ubuntu6.17","1:6.2+dfsg-2ubuntu6.18","1:6.2+dfsg-2ubuntu6.19","1:6.2+dfsg-2ubuntu6.21","1:6.2+dfsg-2ubuntu6.22","1:6.2+dfsg-2ubuntu6.23","1:6.2+dfsg-2ubuntu6.24","1:6.2+dfsg-2ubuntu6.25","1:6.2+dfsg-2ubuntu6.26","1:6.2+dfsg-2ubuntu6.27"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.2.2+ds-0ubuntu1.13"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9","1:8.2.2+ds-0ubuntu1.10","1:8.2.2+ds-0ubuntu1.11","1:8.2.2+ds-0ubuntu1.12"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0+ds-5ubuntu2.4"}]}],"versions":["1:9.2.1+ds-1ubuntu5","1:10.0.2+ds-1ubuntu1","1:10.0.2+ds-1ubuntu2","1:10.1.0+ds-1ubuntu1","1:10.1.0+ds-5ubuntu1","1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu2.1","1:10.1.0+ds-5ubuntu2.2"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.3-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.7-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.7-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-12464","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2408845","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.com/qemu-project/qemu/-/issues/3043","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12464","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-59fq-gggw-pqjr"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-12464","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12464.json","tags":["advisory"]},{"url":"https://gitlab.com/qemu-project/qemu","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-12464","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11234","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0665","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1353","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1354","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1355","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1848","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521230-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230042","tags":["report"]},{"url":"https://bugzilla.suse.com/1250984","tags":["report"]},{"url":"https://bugzilla.suse.com/1253002","tags":["report"]},{"url":"https://bugzilla.suse.com/1254286","tags":["report"]},{"url":"https://bugzilla.suse.com/1254494","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12464","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521233-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260022-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1252768","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260039-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227397","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6505","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260043-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1209554","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1544","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260288-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620008-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620038-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240157","tags":["report"]},{"url":"https://bugzilla.suse.com/1243013","tags":["report"]},{"url":"https://bugzilla.suse.com/1246566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-12464","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-12464","tags":["report"]},{"url":"https://lore.kernel.org/qemu-devel/20251028160042.3321933-1-peter.maydell@linaro.org/T/#u","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8073-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-8354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-11234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14876","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-0665","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-12464","title":"Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode","description":"A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2025-10-31T21:15:48.885Z","modified":"2026-11-05T14:15:50.836Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2025-37403","description":"A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2025-10-31T21:15:48Z","modified":"2026-11-05T14:15:50Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:59:57.845813Z"}],"ghsa":[{"id":"GHSA-59fq-gggw-pqjr","title":"A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding...","description":"A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2025-11-01T00:30:26Z","modified":"2026-05-06T18:30:24Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:07:55.247215Z"}],"nvd":[{"id":"CVE-2025-12464","description":"A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2025-10-31T22:15:32.977Z","modified":"2026-11-05T15:17:09.067Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-05T19:55:51.56159Z"}],"osv":[{"id":"BELL-CVE-2025-12464","status":"published","published":"2025-11-01T06:05:15.14175Z","modified":"2026-08-15T07:15:07.201019034Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-12464","title":"Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode","description":"A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2025-10-31T21:15:48.885Z","modified":"2026-11-07T02:30:25.49594964Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-07T03:07:55.437794Z"},{"id":"DEBIAN-CVE-2025-12464","description":"A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2025-10-31T22:15:32.977Z","modified":"2026-10-23T17:47:47.570043747Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"OESA-2026-1351","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)\n\nA stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device\u0026apos;s receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)\n\nAn \u0026amp;quot;off by one\u0026amp;quot; bug has been discovered in QEMU\u0026amp;#39;s KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)","status":"published","published":"2026-02-13T11:10:22Z","modified":"2026-08-18T01:19:32.567000307Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1353","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)\n\nA stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device\u0026apos;s receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)","status":"published","published":"2026-02-13T11:10:22Z","modified":"2026-08-18T01:19:33.167057334Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1354","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)\n\nA stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device\u0026apos;s receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)\n\nAn \u0026amp;quot;off by one\u0026amp;quot; bug has been discovered in QEMU\u0026amp;#39;s KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)","status":"published","published":"2026-02-13T11:10:23Z","modified":"2026-08-18T01:19:32.46224106Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1355","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)\n\nA stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device\u0026apos;s receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)\n\nAn \u0026amp;quot;off by one\u0026amp;quot; bug has been discovered in QEMU\u0026amp;#39;s KVM Xen guest support. A malicious client could exploit this vulnerability to trigger an out-of-bounds heap access in the QEMU process via the simulated Xen physical device overshoot interface, resulting in a denial of service or potential memory corruption.(CVE-2026-0665)","status":"published","published":"2026-02-13T11:10:23Z","modified":"2026-08-18T01:19:32.601563691Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1848","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.(CVE-2025-11234)\n\nA stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device\u0026apos;s receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.(CVE-2025-12464)","status":"published","published":"2026-04-11T11:10:52Z","modified":"2026-08-18T01:19:46.766596269Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"UBUNTU-CVE-2025-12464","description":"A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2025-10-31T22:15:00Z","modified":"2026-03-05T18:43:38.258953Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"AZL-69631","title":"CVE-2025-12464 affecting package qemu for versions less than 8.2.0-25","description":"A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2025-10-31T22:15:32Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.144367Z"},{"id":"openSUSE-SU-2025:15821-1","title":"qemu-10.1.3-1.1 on GA media","description":"These are all security issues fixed in the qemu-10.1.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-15T00:00:00Z","modified":"2026-03-23T04:54:13.08585Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2025:20171-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nUpdate to version 10.0.7.\n\nSecurity issues fixed:\n\n- CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious\n  guest user to crash the QEMU process on the host (bsc#1253002).\n- CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network\n  access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).\n\nOther updates and bugfixes:\n\n- Version 10.0.7:\n  * kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value\n  * docs/devel: Update URL for make-pullreq script\n  * target/arm: Fix assert on BRA.\n  * hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN\n  * hw/core/machine: Provide a description for aux-ram-share property\n  * hw/pci: Make msix_init take a uint32_t for nentries\n  * block/io_uring: avoid potentially getting stuck after resubmit at the end of ioq_submit()\n  * block-backend: Fix race when resuming queued requests\n  * ui/vnc: Fix qemu abort when query vnc info\n  * chardev/char-pty: Do not ignore chr_write() failures\n  * hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()\n  * hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs\n  * hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure\n  * migration: Fix transition to COLO state from precopy\n  * Full backport list: https://lore.kernel.org/qemu-devel/1765037524.347582.2700543.nullmailer@tls.msk.ru/\n\n- Version 10.0.6:\n  * linux-user/microblaze: Fix little-endianness binary\n  * target/hppa: correct size bit parity for fmpyadd\n  * target/i386: user: do not set up a valid LDT on reset\n  * async: access bottom half flags with qatomic_read\n  * target/i386: fix x86_64 pushw op\n  * i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit\n  * i386/cpu: Prevent delivering SIPI during SMM in TCG mode\n  * i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS\n  * target/i386: Fix CR2 handling for non-canonical addresses\n  * block/curl.c: Use explicit long constants in curl_easy_setopt calls\n  * pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs\n  * target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN2 and SEWd\n  * target/riscv: Fix ssamoswap error handling\n  * Full backport list: https://lore.kernel.org/qemu-devel/1761022287.744330.6357.nullmailer@tls.msk.ru/\n\n- Version 10.0.5:\n  * tests/functional/test_aarch64_sbsaref_freebsd: Fix the URL of the ISO image\n  * tests/functional/test_ppc_bamboo: Replace broken link with working assets\n  * physmem: Destroy all CPU AddressSpaces on unrealize\n  * memory: New AS helper to serialize destroy+free\n  * include/system/memory.h: Clarify address_space_destroy() behaviour\n  * migration: Fix state transition in postcopy_start() error handling\n  * target/riscv: rvv: Modify minimum VLEN according to enabled vector extensions\n  * target/riscv: rvv: Replace checking V by checking Zve32x\n  * target/riscv: Fix endianness swap on compressed instructions\n  * hw/riscv/riscv-iommu: Fixup PDT Nested Walk\n  * Full backport list: https://lore.kernel.org/qemu-devel/1759986125.676506.643525.nullmailer@tls.msk.ru/\n\n- [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).\n- [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).\n","status":"published","published":"2025-12-18T12:42:03Z","modified":"2026-03-23T04:54:19.312735Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"SUSE-SU-2025:21230-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nUpdate to version 10.0.7.\n\nSecurity issues fixed:\n\n- CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious\n  guest user to crash the QEMU process on the host (bsc#1253002).\n- CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network\n  access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).\n\nOther updates and bugfixes:\n\n- Version 10.0.7:\n  * kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value\n  * docs/devel: Update URL for make-pullreq script\n  * target/arm: Fix assert on BRA.\n  * hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN\n  * hw/core/machine: Provide a description for aux-ram-share property\n  * hw/pci: Make msix_init take a uint32_t for nentries\n  * block/io_uring: avoid potentially getting stuck after resubmit at the end of ioq_submit()\n  * block-backend: Fix race when resuming queued requests\n  * ui/vnc: Fix qemu abort when query vnc info\n  * chardev/char-pty: Do not ignore chr_write() failures\n  * hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()\n  * hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs\n  * hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure\n  * migration: Fix transition to COLO state from precopy\n  * Full backport list: https://lore.kernel.org/qemu-devel/1765037524.347582.2700543.nullmailer@tls.msk.ru/\n\n- Version 10.0.6:\n  * linux-user/microblaze: Fix little-endianness binary\n  * target/hppa: correct size bit parity for fmpyadd\n  * target/i386: user: do not set up a valid LDT on reset\n  * async: access bottom half flags with qatomic_read\n  * target/i386: fix x86_64 pushw op\n  * i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit\n  * i386/cpu: Prevent delivering SIPI during SMM in TCG mode\n  * i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS\n  * target/i386: Fix CR2 handling for non-canonical addresses\n  * block/curl.c: Use explicit long constants in curl_easy_setopt calls\n  * pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs\n  * target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN2 and SEWd\n  * target/riscv: Fix ssamoswap error handling\n  * Full backport list: https://lore.kernel.org/qemu-devel/1761022287.744330.6357.nullmailer@tls.msk.ru/\n\n- Version 10.0.5:\n  * tests/functional/test_aarch64_sbsaref_freebsd: Fix the URL of the ISO image\n  * tests/functional/test_ppc_bamboo: Replace broken link with working assets\n  * physmem: Destroy all CPU AddressSpaces on unrealize\n  * memory: New AS helper to serialize destroy+free\n  * include/system/memory.h: Clarify address_space_destroy() behaviour\n  * migration: Fix state transition in postcopy_start() error handling\n  * target/riscv: rvv: Modify minimum VLEN according to enabled vector extensions\n  * target/riscv: rvv: Replace checking V by checking Zve32x\n  * target/riscv: Fix endianness swap on compressed instructions\n  * hw/riscv/riscv-iommu: Fixup PDT Nested Walk\n  * Full backport list: https://lore.kernel.org/qemu-devel/1759986125.676506.643525.nullmailer@tls.msk.ru/\n\n- [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).\n- [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).\n","status":"published","published":"2025-12-18T12:38:54Z","modified":"2026-03-23T04:49:18.349005Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:21233-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nUpdate to version 10.0.7.\n\nSecurity issues fixed:\n\n- CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious\n  guest user to crash the QEMU process on the host (bsc#1253002).\n- CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network\n  access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).\n\nOther updates and bugfixes:\n\n- Version 10.0.7:\n  * kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value\n  * docs/devel: Update URL for make-pullreq script\n  * target/arm: Fix assert on BRA.\n  * hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN\n  * hw/core/machine: Provide a description for aux-ram-share property\n  * hw/pci: Make msix_init take a uint32_t for nentries\n  * block/io_uring: avoid potentially getting stuck after resubmit at the end of ioq_submit()\n  * block-backend: Fix race when resuming queued requests\n  * ui/vnc: Fix qemu abort when query vnc info\n  * chardev/char-pty: Do not ignore chr_write() failures\n  * hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()\n  * hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs\n  * hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure\n  * migration: Fix transition to COLO state from precopy\n  * Full backport list: https://lore.kernel.org/qemu-devel/1765037524.347582.2700543.nullmailer@tls.msk.ru/\n\n- Version 10.0.6:\n  * linux-user/microblaze: Fix little-endianness binary\n  * target/hppa: correct size bit parity for fmpyadd\n  * target/i386: user: do not set up a valid LDT on reset\n  * async: access bottom half flags with qatomic_read\n  * target/i386: fix x86_64 pushw op\n  * i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit\n  * i386/cpu: Prevent delivering SIPI during SMM in TCG mode\n  * i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS\n  * target/i386: Fix CR2 handling for non-canonical addresses\n  * block/curl.c: Use explicit long constants in curl_easy_setopt calls\n  * pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs\n  * target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN2 and SEWd\n  * target/riscv: Fix ssamoswap error handling\n  * Full backport list: https://lore.kernel.org/qemu-devel/1761022287.744330.6357.nullmailer@tls.msk.ru/\n\n- Version 10.0.5:\n  * tests/functional/test_aarch64_sbsaref_freebsd: Fix the URL of the ISO image\n  * tests/functional/test_ppc_bamboo: Replace broken link with working assets\n  * physmem: Destroy all CPU AddressSpaces on unrealize\n  * memory: New AS helper to serialize destroy+free\n  * include/system/memory.h: Clarify address_space_destroy() behaviour\n  * migration: Fix state transition in postcopy_start() error handling\n  * target/riscv: rvv: Modify minimum VLEN according to enabled vector extensions\n  * target/riscv: rvv: Replace checking V by checking Zve32x\n  * target/riscv: Fix endianness swap on compressed instructions\n  * hw/riscv/riscv-iommu: Fixup PDT Nested Walk\n  * Full backport list: https://lore.kernel.org/qemu-devel/1759986125.676506.643525.nullmailer@tls.msk.ru/\n\n- [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).\n- [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).\n","status":"published","published":"2025-12-18T12:38:54Z","modified":"2026-03-23T04:50:20.470651Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:0022-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious\n  guest user to crash the QEMU process on the host (bsc#1253002).\n- CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network\n  access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).\n\nOther updates and bugfixes:\n \n- [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).\n- block/curl: fix curl internal handles handling (bsc#1252768).\n","status":"published","published":"2026-01-05T11:18:23Z","modified":"2026-03-23T04:51:36.041128Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0039-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2024-6505: qemu-kvm: virtio-net: Fixed queue index \n  out-of-bounds access in software RSS (bsc#1227397)\n- CVE-2025-12464: net: pad packets to minimum length in \n  qemu_receive_packet() (bsc#1253002)\n- CVE-2025-11234: qemu-kvm: Fixed use-after-free in websocket \n  handshake code leading to denial of service (bsc#1250984)\n\nOther fixes:\n- Fixed *-virtio-gpu-pci dependency on ARM (bsc#1254286)\n- block/curl: Fixed curl internal handles handling (bsc#1252768)\n","status":"published","published":"2026-01-06T10:31:23Z","modified":"2026-03-23T04:51:53.779083Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0043-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2023-1544: out-of-bounds read in VMWare's paravirtual RDMA device operations can be exploited through a malicious\n  guest driver to crash the QEMU process on the host (bsc#1209554).\n- CVE-2024-6505: heap-based buffer overflow in the virtio-net device operations can be exploited by a malicious\n  privileged user to crash the QEMU process on the host (bsc#1227397).\n- CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious\n  guest user to crash the QEMU process on the host (bsc#1253002).\n\nOther updates and bugfixes: \n  \n- [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too.\n- [openSUSE][RPM} spec: delete old specfile constructs.\n- block/curl: fix curl internal handles handling (bsc#1252768).\n- [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).\n","status":"published","published":"2026-01-06T16:03:07Z","modified":"2026-02-04T03:05:12.391355Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0288-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious\n  guest user to crash the QEMU process on the host (bsc#1253002).\n- CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network\n  access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).\n\nOther updates and bugfixes:\n\n- [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too.\n- [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).\n- [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).\n- block/curl: fix curl internal handles handling (bsc#1252768).\n- [openSUSE][RPM] spec: qemu-vgabios is required on ppc (bsc#1230042).\n","status":"published","published":"2026-01-26T09:04:46Z","modified":"2026-03-23T04:52:06.132568Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20008-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious\n  guest user to crash the QEMU process on the host (bsc#1253002).\n- CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network\n  access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).\n  \nOther updates and bugfixes:\n  \n- [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).\n- block/curl: fix curl internal handles handling (bsc#1252768).\n\n","status":"published","published":"2025-12-22T15:42:55Z","modified":"2026-03-23T04:52:28.829258Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20038-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nUpdate to version 8.2.10.\n\nSecurity issues fixed:\n\n- CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a malicious\n  guest user to crash the QEMU process on the host (bsc#1253002).\n- CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client with network\n  access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).\n\nOther updates and bugfixes:\n\n- [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too.\n- [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).\n- block/curl: fix curl internal handles handling (bsc#1252768).\n- [openSUSE][RPM]: spec: qemu-vgabios is required on ppc (bsc#1230042).\n- [roms] seabios: include \"pciinit: don't misalign large BARs\" (bsc#1246566).\n- [openSUSE][RPM] spec: Require ipxe and virtio-gpu packages for more arch-es (bsc#1240157).\n- [openSUSE][RPM]: disable LTO for userspace emulation on 15.6 (bsc#1243013).\n\n- Version 8.2.10 changes:\n  * Full changelog: https://lore.kernel.org/qemu-devel/7dd1fbc7-a58f-4b2c-82b9-735840246ab2@tls.msk.ru/\n  * Some backports:\n    - hw/misc/aspeed_hace: Fix buffer overflow in has_padding function\n    - target/ppc: Fix e200 duplicate SPRs\n    - linux-user/riscv: Fix handling of cpu mask in riscv_hwprobe syscall\n    - docs/about/emulation: Fix broken link\n    - vdpa: Allow vDPA to work on big-endian machine\n    - vdpa: Fix endian bugs in shadow virtqueue\n    - target/loongarch: Fix vldi inst\n    - target/arm: Simplify pstate_sm check in sve_access_check\n    - target/arm: Make DisasContext.{fp, sve}_access_checked tristate\n    - util/cacheflush: Make first DSB unconditional on aarch64\n    - ui/cocoa: Temporarily ignore annoying deprecated declaration warnings\n    - docs: Rename default-configs to configs\n    - block: Zero block driver state before reopening\n    - hw/xen/hvm: Fix Aarch64 typo\n    - hw/net/smc91c111: Don't allow data register access to overrun buffer\n    - hw/net/smc91c111: Sanitize packet length on tx\n    - hw/net/smc91c111: Sanitize packet numbers\n    - hw/net/smc91c111: Ignore attempt to pop from empty RX fifo\n    - ppc/pnv/occ: Fix common area sensor offsets\n    - net: move backend cleanup to NIC cleanup\n    - net: parameterize the removing client from nc list\n    - util/qemu-timer.c: Don't warp timer from timerlist_rearm()\n    - target/arm: Correct STRD atomicity\n    - target/arm: Correct LDRD atomicity and fault behaviour\n","status":"published","published":"2026-01-06T11:41:24Z","modified":"2026-03-23T04:52:30.681274Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"USN-8073-1","title":"qemu vulnerabilities","description":"It was discovered that the UHCI controller implementation of QEMU could be\nbrought into an invalid state. An attacker inside the guest could possibly\nuse this issue to cause QEMU to crash, resulting in a denial of service.\n(CVE-2024-8354)\n\nIt was discovered that QEMU incorrectly handled memory during certain VNC\noperations. An remote attacker could possibly use this issue to cause QEMU\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2025-11234)\n\nIt was discovered that the e1000 network device implementation of QEMU\ncould be made to write out of bounds. An attacker inside the guest could\npossibly use this issue to cause QEMU to crash, resulting in a denial of\nservice, or possibly execute arbitrary code. This issue only affected\nUbuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-12464)\n\nIt was discovered that the virtio-crypto device implementation of QEMU did\nnot limit the length of a certain path input. An attacker inside the guest\ncould possibly use this issue to cause QEMU to consume large amount of\nmemory, resulting in a denial of service. This issue only affected Ubuntu\n24.04 LTS and Ubuntu 25.10. (CVE-2025-14876)\n\nIt was discovered that the KVM Xen guest support of QEMU could be made to\nread out of bounds. An attacker inside the guest could possibly use this\nissue to cause QEMU to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-0665)","status":"published","published":"2026-03-04T16:13:14Z","modified":"2026-04-27T18:47:23.608373839Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}