{"id":"CVE-2026-6502","aliases":["BELL-CVE-2026-6502","DEBIAN-CVE-2026-6502","MGASA-2026-0334","UBUNTU-CVE-2026-6502"],"status":"published","title":"Updated qemu packages fix many security vulnerabilities","description":"This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from\n10.2.4","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-05-05T18:01:24.395444Z","modified":"2026-10-22T23:20:45Z","fixes":[{"ecosystem":"Alpaquita:25","package":"qemu","fixed_in":["10.0.9-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"qemu","fixed_in":["11.0.0-r1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:10.0.10+ds-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:11.0.0+ds-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:25","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r1"},{"fixed":"10.0.9-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.2-r0"},{"fixed":"11.0.0-r1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.10+ds-0+deb13u1"}]}],"versions":["1:10.0.2+ds-2","1:10.0.2+ds-2+deb13u1","1:10.0.2+ds-2+deb13u1~bpo12+1","1:10.0.3+ds-0+deb13u1","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.0.6+ds-0+deb13u1","1:10.0.6+ds-0+deb13u2","1:10.0.7+ds-0+deb13u1","1:10.0.8+ds-0+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.0+ds-2"}]}],"versions":["1:10.0.2+ds-2","1:10.0.3+ds-1","1:10.0.3+ds-2","1:10.0.3+ds-3","1:10.0.3+ds-4","1:10.1.0+ds-1","1:10.1.0+ds-2","1:10.1.0+ds-3","1:10.1.0+ds-4","1:10.1.0+ds-5","1:10.1.0~rc0+ds-1","1:10.1.0~rc0+ds-2","1:10.1.0~rc0+ds-3","1:10.1.0~rc0+ds-4","1:10.1.0~rc1+ds-1","1:10.1.0~rc1+ds-1a","1:10.1.0~rc1+ds-1b","1:10.1.0~rc1+ds-2","1:10.1.0~rc1+ds-3","1:10.1.0~rc2+ds-1","1:10.1.0~rc3+ds-1","1:10.1.0~rc3+ds-2","1:10.1.1+ds-1","1:10.1.2+ds-1","1:10.1.2+ds-2","1:10.1.2+ds-3","1:10.1.3+ds-1","1:10.2.0+ds-1","1:10.2.0+ds-2","1:10.2.0~rc1+ds-1","1:10.2.1+ds-1","1:10.2.2+ds-1","1:11.0.0+ds-1","1:11.0.0~rc0+ds-1","1:11.0.0~rc0+ds-2","1:11.0.0~rc1+ds-1","1:11.0.0~rc1+ds-2","1:11.0.0~rc1+ds-3","1:11.0.0~rc2+ds-1","1:11.0.0~rc2+ds-2","1:11.0.0~rc3+ds-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.4-2.mga10"}]}],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.2.1+ds-1ubuntu5","1:10.0.2+ds-1ubuntu1","1:10.0.2+ds-1ubuntu2","1:10.1.0+ds-1ubuntu1","1:10.1.0+ds-5ubuntu1","1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu2.1","1:10.1.0+ds-5ubuntu2.2","1:10.1.0+ds-5ubuntu2.4","1:10.1.0+ds-5ubuntu2.5","1:10.1.0+ds-5ubuntu2.6","1:10.1.0+ds-5ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu3","1:10.2.1+ds-1ubuntu6","1:11.0.3+ds-2ubuntu1","1:11.0.3+ds-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qemu-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu4","1:10.2.1+ds-1ubuntu7","1:10.2.1+ds-1ubuntu8","1:11.0.3+ds-2ubuntu2","1:11.0.3+ds-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.1.0+ds-5ubuntu2","1:10.1.0+ds-5ubuntu3","1:10.1.0+ds-5ubuntu4","1:10.1.0+ds-5ubuntu5","1:10.2.1+ds-1ubuntu1","1:10.2.1+ds-1ubuntu2","1:10.2.1+ds-1ubuntu3","1:10.2.1+ds-1ubuntu3.1","1:10.2.1+ds-1ubuntu3.2","1:10.2.1+ds-1ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"qemu-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.2.1+ds-1ubuntu2","1:10.2.1+ds-1ubuntu4","1:10.2.1+ds-1ubuntu4.2","1:10.2.1+ds-1ubuntu4.3","1:10.2.1+ds-1ubuntu4.4"]}],"references":[{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-6502","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-6502","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0334.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35989","tags":["report"]},{"url":"https://lists.nongnu.org/archive/html/qemu-stable/2026-05/msg00654.html","tags":["web"]},{"url":"https://lists.nongnu.org/archive/html/qemu-stable/2026-06/msg00551.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-6502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6502","tags":["report"]}],"sources":{"osv":[{"id":"BELL-CVE-2026-6502","status":"published","published":"2026-05-07T06:10:20.969096Z","modified":"2026-05-11T07:15:18.143389Z","updated_at":"2026-11-02T15:28:25.231222Z"},{"id":"DEBIAN-CVE-2026-6502","status":"published","published":"2026-05-05T18:01:24.395444Z","modified":"2026-07-11T21:00:41.068438989Z","updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"MGASA-2026-0334","title":"Updated qemu packages fix many security vulnerabilities","description":"This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from\n10.2.4\n","status":"published","published":"2026-08-13T16:40:34Z","modified":"2026-08-13T16:58:46.791228786Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"UBUNTU-CVE-2026-6502","description":"hw/display: don't accidentally autofree existing virgl resources","status":"published","published":"2026-05-06T00:00:00Z","modified":"2026-10-22T23:20:45.973226766Z","updated_at":"2026-11-02T16:56:53.710209Z"}]}}