{"id":"CVE-2026-3886","aliases":["BELL-CVE-2026-3886","DEBIAN-CVE-2026-3886","MGASA-2026-0334","OESA-2026-2861","OESA-2026-2952","SUSE-SU-2026:22550-1","SUSE-SU-2026:22576-1","SUSE-SU-2026:23351-1","SUSE-SU-2026:23362-1","SUSE-SU-2026:3038-1","SUSE-SU-2026:3806-1","UBUNTU-CVE-2026-3886","openSUSE-SU-2026:21253-1"],"status":"published","title":"Updated qemu packages fix many security vulnerabilities","description":"This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from\n10.2.4","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-07-06T11:11:46Z","modified":"2026-10-22T23:20:04Z","fixes":[{"ecosystem":"Alpaquita:25","package":"qemu","fixed_in":["10.0.12-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"qemu","fixed_in":["11.0.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:10.0.10+ds-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:11.0.0+ds-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"qemu","fixed_in":["8.2.10-slfo.1.1_6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"qemu","fixed_in":["8.2.10-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"qemu","fixed_in":["8.2.10-150600.3.52.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"qemu","fixed_in":["8.2.10-150600.3.52.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r1"},{"fixed":"10.0.12-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.2-r0"},{"fixed":"11.0.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.10+ds-0+deb13u1"}]}],"versions":["1:10.0.2+ds-2","1:10.0.2+ds-2+deb13u1","1:10.0.2+ds-2+deb13u1~bpo12+1","1:10.0.3+ds-0+deb13u1","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.0.6+ds-0+deb13u1","1:10.0.6+ds-0+deb13u2","1:10.0.7+ds-0+deb13u1","1:10.0.8+ds-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.0+ds-1"}]}],"versions":["1:10.0.2+ds-2","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.1.0+ds-1","1:10.1.0+ds-2","1:10.1.0+ds-3","1:10.1.0+ds-4","1:10.1.0+ds-5","1:10.1.0~rc0+ds-1","1:10.1.0~rc0+ds-2","1:10.1.0~rc0+ds-3","1:10.1.0~rc0+ds-4","1:10.1.0~rc1+ds-1","1:10.1.0~rc1+ds-1a","1:10.1.0~rc1+ds-1b","1:10.1.0~rc1+ds-2","1:10.1.0~rc1+ds-3","1:10.1.0~rc2+ds-1","1:10.1.0~rc3+ds-1","1:10.1.0~rc3+ds-2","1:10.1.1+ds-1","1:10.1.2+ds-1","1:10.1.2+ds-2","1:10.1.2+ds-3","1:10.1.3+ds-1","1:10.2.0+ds-1","1:10.2.0+ds-2","1:10.2.0~rc1+ds-1","1:10.2.1+ds-1","1:10.2.2+ds-1","1:11.0.0~rc0+ds-1","1:11.0.0~rc0+ds-2","1:11.0.0~rc1+ds-1","1:11.0.0~rc1+ds-2","1:11.0.0~rc1+ds-3","1:11.0.0~rc2+ds-1","1:11.0.0~rc2+ds-2","1:11.0.0~rc3+ds-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.4-2.mga10"}]}],"bundled":16},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-80.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-56.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.11-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.11-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.11-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.11-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.11-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-slfo.1.1_6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.4-150700.3.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.52.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.10-150600.3.52.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.0.4+dfsg-1ubuntu3","1:8.0.4+dfsg-1ubuntu4","1:8.0.4+dfsg-1ubuntu5","1:8.1.3+ds-1ubuntu2","1:8.2.1+ds-1ubuntu1","1:8.2.1+ds-1ubuntu8","1:8.2.1+ds-1ubuntu9","1:8.2.2+ds-0ubuntu1","1:8.2.2+ds-0ubuntu1.2","1:8.2.2+ds-0ubuntu1.4","1:8.2.2+ds-0ubuntu1.5","1:8.2.2+ds-0ubuntu1.6","1:8.2.2+ds-0ubuntu1.7","1:8.2.2+ds-0ubuntu1.8","1:8.2.2+ds-0ubuntu1.9","1:8.2.2+ds-0ubuntu1.10","1:8.2.2+ds-0ubuntu1.11","1:8.2.2+ds-0ubuntu1.12","1:8.2.2+ds-0ubuntu1.13","1:8.2.2+ds-0ubuntu1.14","1:8.2.2+ds-0ubuntu1.15","1:8.2.2+ds-0ubuntu1.16","1:8.2.2+ds-0ubuntu1.17","1:8.2.2+ds-0ubuntu1.18"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.2.1+ds-1ubuntu5","1:10.0.2+ds-1ubuntu1","1:10.0.2+ds-1ubuntu2","1:10.1.0+ds-1ubuntu1","1:10.1.0+ds-5ubuntu1","1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu2.1","1:10.1.0+ds-5ubuntu2.2","1:10.1.0+ds-5ubuntu2.4","1:10.1.0+ds-5ubuntu2.5","1:10.1.0+ds-5ubuntu2.6","1:10.1.0+ds-5ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu3","1:10.2.1+ds-1ubuntu6","1:11.0.3+ds-2ubuntu1","1:11.0.3+ds-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qemu-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu4","1:10.2.1+ds-1ubuntu7","1:10.2.1+ds-1ubuntu8","1:11.0.3+ds-2ubuntu2","1:11.0.3+ds-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu3","1:10.1.0+ds-5ubuntu4","1:10.1.0+ds-5ubuntu5","1:10.2.1+ds-1ubuntu1","1:10.2.1+ds-1ubuntu2","1:10.2.1+ds-1ubuntu3","1:10.2.1+ds-1ubuntu3.1","1:10.2.1+ds-1ubuntu3.2","1:10.2.1+ds-1ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qemu-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu2","1:10.2.1+ds-1ubuntu4","1:10.2.1+ds-1ubuntu4.2","1:10.2.1+ds-1ubuntu4.3","1:10.2.1+ds-1ubuntu4.4"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.11-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.11-160000.1.1"}]}],"bundled":3}],"references":[{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-3886","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-3886","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0334.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35989","tags":["report"]},{"url":"https://lists.nongnu.org/archive/html/qemu-stable/2026-05/msg00654.html","tags":["web"]},{"url":"https://lists.nongnu.org/archive/html/qemu-stable/2026-06/msg00551.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48914","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2952","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622550-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1199023","tags":["report"]},{"url":"https://bugzilla.suse.com/1268061","tags":["report"]},{"url":"https://bugzilla.suse.com/1268279","tags":["report"]},{"url":"https://bugzilla.suse.com/1268794","tags":["report"]},{"url":"https://bugzilla.suse.com/1270133","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3886","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48914","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622576-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623351-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1273447","tags":["report"]},{"url":"https://bugzilla.suse.com/1275490","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623362-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263038-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263806-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-3886","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3886","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"osv":[{"id":"OESA-2026-2861","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as critical, has been found in QEMU (Virtualization Software) (version unknown).Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Impacted is confidentiality, integrity, and availability.Upgrading eliminates this vulnerability.(CVE-2026-3886)\n\nA flaw was found in QEMU\u0026apos;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.(CVE-2026-48914)","status":"published","published":"2026-07-06T11:11:46Z","modified":"2026-08-18T01:21:14.248807093Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2952","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as critical, has been found in QEMU (Virtualization Software) (version unknown).Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Impacted is confidentiality, integrity, and availability.Upgrading eliminates this vulnerability.(CVE-2026-3886)\n\nA flaw was found in QEMU\u0026apos;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.(CVE-2026-48914)","status":"published","published":"2026-07-09T11:11:51Z","modified":"2026-08-18T01:21:16.814867958Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"BELL-CVE-2026-3886","status":"published","published":"2026-07-11T06:04:30.597904Z","modified":"2026-08-15T07:15:04.203653671Z","updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"DEBIAN-CVE-2026-3886","status":"published","published":"2026-07-09T10:48:11.105450377Z","modified":"2026-07-11T21:00:19.624555446Z","updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"MGASA-2026-0334","title":"Updated qemu packages fix many security vulnerabilities","description":"This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from\n10.2.4\n","status":"published","published":"2026-08-13T16:40:34Z","modified":"2026-08-13T16:58:46.791228786Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21253-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nUpdate to version 10.0.11.\n\nSecurity issues fixed:\n\n- CVE-2026-3886: integer overflow leading to privilege escalation due to lack of proper validation of user-supplied\n  data in the virtio-gpu driver (bsc#1268061).\n- CVE-2026-48914: heap buffer overflow due to improper size validation in virtio-blk SCSI request handling\n  (bsc#1268794).\n- CVE-2026-48004: heap use-after-free race condition due to missing rename lock in v9fs_co_readdir_many (bsc#1270133).\n\nOther updates and bugfixes:\n\n- Version 10.0.11:\n  * Full backport list here: https://lore.kernel.org/qemu-devel/20260627082646.D825717AB67@think4mjt.localdomain/\n- Version 10.0.10:\n  * Full backport list here: https://lore.kernel.org/qemu-devel/20260528061820.CEE521691A9@think4mjt.localdomain/\n- ppc/spapr: Skip system reset for quiesced CPUs (bsc#1268279).\n- i386/tdx: handle TDG.VP.VMCALL \u003cGetQuote\u003e (jsc#PED-9266).\n- i386/tdx: handle TDG.VP.VMCALL \u003cGetTdVmCallInfo\u003e (jsc#PED-9266).\n- update Linux headers to v6.16-rc3 (jsc#PED-9266).\n- i386/cpu: Warn about why CPUID_EXT_PDCM is not available (jsc#PED-9266).\n- i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[] check (jsc#PED-9266).\n- [openSUSE] qemu-ga: fix service file against no-autostart (bsc#1199023).\n","status":"published","published":"2026-07-07T17:20:48Z","modified":"2026-07-09T10:00:12.147580642Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22550-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nUpdate to version 10.0.11.\n\nSecurity issues fixed:\n\n- CVE-2026-3886: integer overflow leading to privilege escalation due to lack of proper validation of user-supplied\n  data in the virtio-gpu driver (bsc#1268061).\n- CVE-2026-48914: heap buffer overflow due to improper size validation in virtio-blk SCSI request handling\n  (bsc#1268794).\n- CVE-2026-48004: heap use-after-free race condition due to missing rename lock in v9fs_co_readdir_many (bsc#1270133).\n\nOther updates and bugfixes:\n\n- Version 10.0.11:\n  * Full backport list here: https://lore.kernel.org/qemu-devel/20260627082646.D825717AB67@think4mjt.localdomain/\n- Version 10.0.10:\n  * Full backport list here: https://lore.kernel.org/qemu-devel/20260528061820.CEE521691A9@think4mjt.localdomain/\n- ppc/spapr: Skip system reset for quiesced CPUs (bsc#1268279).\n- i386/tdx: handle TDG.VP.VMCALL \u003cGetQuote\u003e (jsc#PED-9266).\n- i386/tdx: handle TDG.VP.VMCALL \u003cGetTdVmCallInfo\u003e (jsc#PED-9266).\n- update Linux headers to v6.16-rc3 (jsc#PED-9266).\n- i386/cpu: Warn about why CPUID_EXT_PDCM is not available (jsc#PED-9266).\n- i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[] check (jsc#PED-9266).\n- [openSUSE] qemu-ga: fix service file against no-autostart (bsc#1199023).\n","status":"published","published":"2026-07-07T17:18:22Z","modified":"2026-07-14T18:24:37.505578208Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22576-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nUpdate to version 10.0.11.\n\nSecurity issues fixed:\n\n- CVE-2026-3886: integer overflow leading to privilege escalation due to lack of proper validation of user-supplied\n  data in the virtio-gpu driver (bsc#1268061).\n- CVE-2026-48914: heap buffer overflow due to improper size validation in virtio-blk SCSI request handling\n  (bsc#1268794).\n- CVE-2026-48004: heap use-after-free race condition due to missing rename lock in v9fs_co_readdir_many (bsc#1270133).\n\nOther updates and bugfixes:\n\n- Version 10.0.11:\n  * Full backport list here: https://lore.kernel.org/qemu-devel/20260627082646.D825717AB67@think4mjt.localdomain/\n- Version 10.0.10:\n  * Full backport list here: https://lore.kernel.org/qemu-devel/20260528061820.CEE521691A9@think4mjt.localdomain/\n- ppc/spapr: Skip system reset for quiesced CPUs (bsc#1268279).\n- i386/tdx: handle TDG.VP.VMCALL \u003cGetQuote\u003e (jsc#PED-9266).\n- i386/tdx: handle TDG.VP.VMCALL \u003cGetTdVmCallInfo\u003e (jsc#PED-9266).\n- update Linux headers to v6.16-rc3 (jsc#PED-9266).\n- i386/cpu: Warn about why CPUID_EXT_PDCM is not available (jsc#PED-9266).\n- i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[] check (jsc#PED-9266).\n- [openSUSE] qemu-ga: fix service file against no-autostart (bsc#1199023).\n","status":"published","published":"2026-07-07T17:18:22Z","modified":"2026-07-15T18:24:12.359676586Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:23351-1","title":"Security update for qemu","description":"This update for qemu fixes the following issue:\n\n- CVE-2026-3886: lack of proper validation of user-supplied data in the `virtio-gpu` driver can lead to local privilege\n  escalation via an integer overflow (bsc#1268061).\n\nOther updates and bugfixes:\n\n- Service: switch back to `tar_scm`.\n- Bug fixes:\n  * target/s390x: Make container ids in `SysIB_15x` 1-based (bsc#1275490).\n  * target/s390x: move `@deprecated-props` to `CpuModelExpansionInfo` (bsc#1273447).\n  * target/s390x: filter deprecated properties based on model expansion type (bsc#1273447).\n  * target/s390x: flag `te` and `cte` as deprecated (bsc#1273447).\n  * target/s390x: report `deprecated-props` in `cpu-model-expansion` reply (bsc#1273447).\n- qemu-ga: fix service file against no-autostart (bsc#1199023).\n","status":"published","published":"2026-08-27T13:26:01Z","modified":"2026-09-10T18:23:12.499348841Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23362-1","title":"Security update for qemu","description":"This update for qemu fixes the following issue:\n\n- CVE-2026-3886: lack of proper validation of user-supplied data in the `virtio-gpu` driver can lead to local privilege\n  escalation via an integer overflow (bsc#1268061).\n\nOther updates and bugfixes:\n\n- Service: switch back to `tar_scm`.\n- Bug fixes:\n  * target/s390x: Make container ids in `SysIB_15x` 1-based (bsc#1275490).\n  * target/s390x: move `@deprecated-props` to `CpuModelExpansionInfo` (bsc#1273447).\n  * target/s390x: filter deprecated properties based on model expansion type (bsc#1273447).\n  * target/s390x: flag `te` and `cte` as deprecated (bsc#1273447).\n  * target/s390x: report `deprecated-props` in `cpu-model-expansion` reply (bsc#1273447).\n- qemu-ga: fix service file against no-autostart (bsc#1199023).\n","status":"published","published":"2026-08-27T12:01:51Z","modified":"2026-09-10T18:23:12.950618316Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3038-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues\n\n- CVE-2026-3886: QEMU calc_image_hostmem Integer Overflow Local Privilege Escalation Vulnerability (bsc#1268061).\n- CVE-2026-48004: heap use-after-free race condition allows a DoS by an unprivileged guest user (bsc#1270133).\n- CVE-2026-48914: qemu-kvm: Heap Buffer Overflow in virtio-blk SCSI Request Handling (bsc#1268794).\n","status":"published","published":"2026-07-15T11:45:31Z","modified":"2026-07-16T10:00:07.931621104Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3806-1","title":"Security update for qemu","description":"This update for qemu fixes the following issue:\n\n- CVE-2026-3886: QEMU calc_image_hostmem Integer Overflow Local Privilege Escalation Vulnerability (bsc#1268061).\n\nChanges for qemu:\n\n- Bug fixes:\n  * target/s390x: Make container ids in SysIB_15x 1-based (bsc#1275490)\n  * target/s390x: move @deprecated-props to CpuModelExpansion Info (bsc#1273447)\n  * target/s390x: filter deprecated properties based on model expansion type (bsc#1273447)\n  * target/s390x: flag te and cte as deprecated (bsc#1273447)\n  * target/s390x: report deprecated-props in cpu-model-expansion reply (bcs#1273447)\n","status":"published","published":"2026-08-26T09:07:17Z","modified":"2026-08-31T18:23:10.020351447Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"UBUNTU-CVE-2026-3886","description":"[virtio-gpu: fix overflow check when allocating 2d image]","status":"published","published":"2026-07-09T00:00:00Z","modified":"2026-10-22T23:20:04.901930267Z","updated_at":"2026-11-02T16:56:16.686388Z"}]}}