CVE-2026-17588
qemu-11.1.2-1.1 on GA media
No scorePublic exploitFix available
CVE-2026-17588 is a vulnerability with no CVSS score yet in qemu, published September 29, 2026. Public exploit code exists. Fixed in qemu 9.0.4-r5.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None known1 public exploit
- Fixed in
9.0.4-r5qemu +16 more
Description
[hw/usb/hcd-xhci: Set reentrancy guard in timer functions]
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuAlpaquita:23 | 7.1.0-r4 up to 9.0.4-r5 | 9.0.4-r5 |
qemuAlpaquita:25 | 10.0.0-r1 up to 10.0.15-r0 | 10.0.15-r0 |
qemuAlpaquita:stream | 8.0.2-r0 up to 11.1.3-r0 | 11.1.3-r0 |
qemuDebian:12 | All versions, plus listed versions 1:10.0.0+ds-11:10.0.0+ds-21:10.0.0+ds-2~bpo12+11:10.0.0+ds-2~bpo12+21:10.0.0~rc0+ds-1 Show 45 moreShow less1:10.0.0~rc0+ds-21:10.0.0~rc1+ds-11:10.0.0~rc1+ds-21:10.0.0~rc2+ds-11:10.0.0~rc2+ds-21:10.0.0~rc3+ds-11:10.0.0~rc3+ds-21:10.0.2+ds-11:10.0.2+ds-21:10.0.2+ds-2~bpo12+11:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-41:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0+ds-11:11.0.0+ds-21:11.0.0~rc0+ds-11:11.0.0~rc0+ds-2 | None known |
qemuDebian:13 | All versions, plus listed versions 1:10.0.10+ds-0+deb13u11:10.0.11+ds-0+deb13u11:10.0.13+ds-0+deb13u11:10.0.2+ds-21:10.0.2+ds-2+deb13u1 Show 45 moreShow less1:10.0.2+ds-2+deb13u1~bpo12+11:10.0.3+ds-0+deb13u11:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-41:10.0.6+ds-0+deb13u11:10.0.6+ds-0+deb13u21:10.0.7+ds-0+deb13u11:10.0.8+ds-0+deb13u11:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0+ds-11:11.0.0+ds-21:11.0.0~rc0+ds-11:11.0.0~rc0+ds-21:11.0.0~rc1+ds-11:11.0.0~rc1+ds-21:11.0.0~rc1+ds-31:11.0.0~rc2+ds-1 | None known |
qemuDebian:14 | before 1:11.1.2+ds-1, plus listed versions 1:10.0.2+ds-21:10.0.3+ds-11:10.0.3+ds-21:10.0.3+ds-31:10.0.3+ds-4 Show 45 moreShow less1:10.1.0+ds-11:10.1.0+ds-21:10.1.0+ds-31:10.1.0+ds-41:10.1.0+ds-51:10.1.0~rc0+ds-11:10.1.0~rc0+ds-21:10.1.0~rc0+ds-31:10.1.0~rc0+ds-41:10.1.0~rc1+ds-11:10.1.0~rc1+ds-1a1:10.1.0~rc1+ds-1b1:10.1.0~rc1+ds-21:10.1.0~rc1+ds-31:10.1.0~rc2+ds-11:10.1.0~rc3+ds-11:10.1.0~rc3+ds-21:10.1.1+ds-11:10.1.2+ds-11:10.1.2+ds-21:10.1.2+ds-31:10.1.3+ds-11:10.2.0+ds-11:10.2.0+ds-21:10.2.0~rc1+ds-11:10.2.1+ds-11:10.2.2+ds-11:11.0.0+ds-11:11.0.0+ds-21:11.0.0~rc0+ds-11:11.0.0~rc0+ds-21:11.0.0~rc1+ds-11:11.0.0~rc1+ds-21:11.0.0~rc1+ds-31:11.0.0~rc2+ds-11:11.0.0~rc2+ds-21:11.0.0~rc3+ds-11:11.0.1+ds-11:11.0.2+ds-11:11.0.2+ds-21:11.0.2+ds-2~bpo13+11:11.0.3+ds-11:11.0.3+ds-21:11.1.0+ds-11:11.1.0+ds-2 | 1:11.1.2+ds-1 |
qemuUbuntu:Pro:14.04:LTS | All versions, plus listed versions 1.5.0+dfsg-3ubuntu51.5.0+dfsg-3ubuntu61.6.0+dfsg-2ubuntu11.6.0+dfsg-2ubuntu21.6.0+dfsg-2ubuntu3 Show 45 moreShow less1.6.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu11.7.0+dfsg-2ubuntu21.7.0+dfsg-2ubuntu31.7.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu51.7.0+dfsg-2ubuntu71.7.0+dfsg-2ubuntu81.7.0+dfsg-2ubuntu91.7.0+dfsg-3ubuntu1~ppa11.7.0+dfsg-3ubuntu11.7.0+dfsg-3ubuntu21.7.0+dfsg-3ubuntu31.7.0+dfsg-3ubuntu41.7.0+dfsg-3ubuntu51.7.0+dfsg-3ubuntu61.7.0+dfsg-3ubuntu72.0.0~rc1+dfsg-0ubuntu12.0.0~rc1+dfsg-0ubuntu22.0.0~rc1+dfsg-0ubuntu32.0.0~rc1+dfsg-0ubuntu3.12.0.0+dfsg-2ubuntu12.0.0+dfsg-2ubuntu1.12.0.0+dfsg-2ubuntu1.22.0.0+dfsg-2ubuntu1.32.0.0+dfsg-2ubuntu1.52.0.0+dfsg-2ubuntu1.62.0.0+dfsg-2ubuntu1.72.0.0+dfsg-2ubuntu1.82.0.0+dfsg-2ubuntu1.92.0.0+dfsg-2ubuntu1.102.0.0+dfsg-2ubuntu1.112.0.0+dfsg-2ubuntu1.132.0.0+dfsg-2ubuntu1.142.0.0+dfsg-2ubuntu1.152.0.0+dfsg-2ubuntu1.162.0.0+dfsg-2ubuntu1.172.0.0+dfsg-2ubuntu1.182.0.0+dfsg-2ubuntu1.192.0.0+dfsg-2ubuntu1.202.0.0+dfsg-2ubuntu1.212.0.0+dfsg-2ubuntu1.222.0.0+dfsg-2ubuntu1.242.0.0+dfsg-2ubuntu1.252.0.0+dfsg-2ubuntu1.26 | None known |
qemuUbuntu:Pro:16.04:LTS | All versions, plus listed versions 1:2.3+dfsg-5ubuntu91:2.3+dfsg-5ubuntu101:2.4+dfsg-4ubuntu11:2.4+dfsg-4ubuntu21:2.4+dfsg-4ubuntu3 Show 45 moreShow less1:2.4+dfsg-5ubuntu31:2.5+dfsg-1ubuntu21:2.5+dfsg-1ubuntu31:2.5+dfsg-1ubuntu41:2.5+dfsg-1ubuntu51:2.5+dfsg-5ubuntu11:2.5+dfsg-5ubuntu21:2.5+dfsg-5ubuntu41:2.5+dfsg-5ubuntu61:2.5+dfsg-5ubuntu71:2.5+dfsg-5ubuntu101:2.5+dfsg-5ubuntu10.11:2.5+dfsg-5ubuntu10.21:2.5+dfsg-5ubuntu10.31:2.5+dfsg-5ubuntu10.41:2.5+dfsg-5ubuntu10.51:2.5+dfsg-5ubuntu10.61:2.5+dfsg-5ubuntu10.71:2.5+dfsg-5ubuntu10.81:2.5+dfsg-5ubuntu10.91:2.5+dfsg-5ubuntu10.101:2.5+dfsg-5ubuntu10.111:2.5+dfsg-5ubuntu10.131:2.5+dfsg-5ubuntu10.141:2.5+dfsg-5ubuntu10.151:2.5+dfsg-5ubuntu10.161:2.5+dfsg-5ubuntu10.201:2.5+dfsg-5ubuntu10.211:2.5+dfsg-5ubuntu10.221:2.5+dfsg-5ubuntu10.241:2.5+dfsg-5ubuntu10.251:2.5+dfsg-5ubuntu10.261:2.5+dfsg-5ubuntu10.281:2.5+dfsg-5ubuntu10.291:2.5+dfsg-5ubuntu10.301:2.5+dfsg-5ubuntu10.311:2.5+dfsg-5ubuntu10.321:2.5+dfsg-5ubuntu10.331:2.5+dfsg-5ubuntu10.341:2.5+dfsg-5ubuntu10.351:2.5+dfsg-5ubuntu10.361:2.5+dfsg-5ubuntu10.371:2.5+dfsg-5ubuntu10.381:2.5+dfsg-5ubuntu10.391:2.5+dfsg-5ubuntu10.40 | None known |
qemuUbuntu:Pro:18.04:LTS | All versions, plus listed versions 1:2.10+dfsg-0ubuntu31:2.10+dfsg-0ubuntu41:2.10+dfsg-0ubuntu51:2.11+dfsg-1ubuntu11:2.11+dfsg-1ubuntu2 Show 45 moreShow less1:2.11+dfsg-1ubuntu41:2.11+dfsg-1ubuntu51:2.11+dfsg-1ubuntu61:2.11+dfsg-1ubuntu71:2.11+dfsg-1ubuntu7.11:2.11+dfsg-1ubuntu7.21:2.11+dfsg-1ubuntu7.31:2.11+dfsg-1ubuntu7.41:2.11+dfsg-1ubuntu7.51:2.11+dfsg-1ubuntu7.61:2.11+dfsg-1ubuntu7.71:2.11+dfsg-1ubuntu7.81:2.11+dfsg-1ubuntu7.91:2.11+dfsg-1ubuntu7.101:2.11+dfsg-1ubuntu7.121:2.11+dfsg-1ubuntu7.131:2.11+dfsg-1ubuntu7.141:2.11+dfsg-1ubuntu7.151:2.11+dfsg-1ubuntu7.171:2.11+dfsg-1ubuntu7.181:2.11+dfsg-1ubuntu7.191:2.11+dfsg-1ubuntu7.201:2.11+dfsg-1ubuntu7.211:2.11+dfsg-1ubuntu7.221:2.11+dfsg-1ubuntu7.231:2.11+dfsg-1ubuntu7.251:2.11+dfsg-1ubuntu7.261:2.11+dfsg-1ubuntu7.271:2.11+dfsg-1ubuntu7.281:2.11+dfsg-1ubuntu7.291:2.11+dfsg-1ubuntu7.311:2.11+dfsg-1ubuntu7.321:2.11+dfsg-1ubuntu7.331:2.11+dfsg-1ubuntu7.341:2.11+dfsg-1ubuntu7.351:2.11+dfsg-1ubuntu7.361:2.11+dfsg-1ubuntu7.371:2.11+dfsg-1ubuntu7.381:2.11+dfsg-1ubuntu7.391:2.11+dfsg-1ubuntu7.401:2.11+dfsg-1ubuntu7.411:2.11+dfsg-1ubuntu7.421:2.11+dfsg-1ubuntu7.42+esm11:2.11+dfsg-1ubuntu7.42+esm21:2.11+dfsg-1ubuntu7.42+esm5 | None known |
qemuUbuntu:Pro:20.04:LTS | All versions, plus listed versions 1:4.0+dfsg-0ubuntu91:4.0+dfsg-0ubuntu101:4.2-1ubuntu11:4.2-1ubuntu21:4.2-3ubuntu1 Show 35 moreShow less1:4.2-3ubuntu21:4.2-3ubuntu31:4.2-3ubuntu41:4.2-3ubuntu51:4.2-3ubuntu61:4.2-3ubuntu6.11:4.2-3ubuntu6.21:4.2-3ubuntu6.31:4.2-3ubuntu6.41:4.2-3ubuntu6.51:4.2-3ubuntu6.61:4.2-3ubuntu6.71:4.2-3ubuntu6.81:4.2-3ubuntu6.91:4.2-3ubuntu6.101:4.2-3ubuntu6.111:4.2-3ubuntu6.121:4.2-3ubuntu6.141:4.2-3ubuntu6.151:4.2-3ubuntu6.161:4.2-3ubuntu6.171:4.2-3ubuntu6.181:4.2-3ubuntu6.191:4.2-3ubuntu6.211:4.2-3ubuntu6.231:4.2-3ubuntu6.241:4.2-3ubuntu6.251:4.2-3ubuntu6.261:4.2-3ubuntu6.271:4.2-3ubuntu6.281:4.2-3ubuntu6.291:4.2-3ubuntu6.301:4.2-3ubuntu6.30+esm11:4.2-3ubuntu6.30+esm21:4.2-3ubuntu6.30+esm3 | None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qemuUbuntu:22.04:LTS | All versions, plus listed versions 1:6.0+dfsg-2expubuntu11:6.0+dfsg-2expubuntu21:6.0+dfsg-2expubuntu41:6.2+dfsg-2ubuntu51:6.2+dfsg-2ubuntu6 Show 30 moreShow less1:6.2+dfsg-2ubuntu6.11:6.2+dfsg-2ubuntu6.21:6.2+dfsg-2ubuntu6.31:6.2+dfsg-2ubuntu6.41:6.2+dfsg-2ubuntu6.51:6.2+dfsg-2ubuntu6.61:6.2+dfsg-2ubuntu6.71:6.2+dfsg-2ubuntu6.81:6.2+dfsg-2ubuntu6.91:6.2+dfsg-2ubuntu6.101:6.2+dfsg-2ubuntu6.111:6.2+dfsg-2ubuntu6.121:6.2+dfsg-2ubuntu6.131:6.2+dfsg-2ubuntu6.141:6.2+dfsg-2ubuntu6.151:6.2+dfsg-2ubuntu6.161:6.2+dfsg-2ubuntu6.171:6.2+dfsg-2ubuntu6.181:6.2+dfsg-2ubuntu6.191:6.2+dfsg-2ubuntu6.211:6.2+dfsg-2ubuntu6.221:6.2+dfsg-2ubuntu6.231:6.2+dfsg-2ubuntu6.241:6.2+dfsg-2ubuntu6.251:6.2+dfsg-2ubuntu6.261:6.2+dfsg-2ubuntu6.271:6.2+dfsg-2ubuntu6.281:6.2+dfsg-2ubuntu6.291:6.2+dfsg-2ubuntu6.301:6.2+dfsg-2ubuntu6.31 | None known |
qemuUbuntu:24.04:LTS | All versions, plus listed versions 1:8.0.4+dfsg-1ubuntu31:8.0.4+dfsg-1ubuntu41:8.0.4+dfsg-1ubuntu51:8.1.3+ds-1ubuntu21:8.2.1+ds-1ubuntu1 Show 19 moreShow less1:8.2.1+ds-1ubuntu81:8.2.1+ds-1ubuntu91:8.2.2+ds-0ubuntu11:8.2.2+ds-0ubuntu1.21:8.2.2+ds-0ubuntu1.41:8.2.2+ds-0ubuntu1.51:8.2.2+ds-0ubuntu1.61:8.2.2+ds-0ubuntu1.71:8.2.2+ds-0ubuntu1.81:8.2.2+ds-0ubuntu1.91:8.2.2+ds-0ubuntu1.101:8.2.2+ds-0ubuntu1.111:8.2.2+ds-0ubuntu1.121:8.2.2+ds-0ubuntu1.131:8.2.2+ds-0ubuntu1.141:8.2.2+ds-0ubuntu1.151:8.2.2+ds-0ubuntu1.161:8.2.2+ds-0ubuntu1.171:8.2.2+ds-0ubuntu1.18 | None known |
qemuUbuntu:26.10 | All versions, plus listed versions 1:10.2.1+ds-1ubuntu31:10.2.1+ds-1ubuntu61:11.0.3+ds-2ubuntu11:11.0.3+ds-2ubuntu2 | None known |
qemu-hweUbuntu:26.10 | All versions, plus listed versions 1:10.2.1+ds-1ubuntu41:10.2.1+ds-1ubuntu71:10.2.1+ds-1ubuntu81:11.0.3+ds-2ubuntu21:11.0.3+ds-2ubuntu4 | None known |
qemuUbuntu:26.04:LTS | All versions, plus listed versions 1:10.1.0+ds-5ubuntu21:10.1.0+ds-5ubuntu31:10.1.0+ds-5ubuntu41:10.1.0+ds-5ubuntu51:10.2.1+ds-1ubuntu1 Show 5 moreShow less1:10.2.1+ds-1ubuntu21:10.2.1+ds-1ubuntu31:10.2.1+ds-1ubuntu3.11:10.2.1+ds-1ubuntu3.21:10.2.1+ds-1ubuntu3.3 | None known |
qemu-hweUbuntu:26.04:LTS | All versions, plus listed versions 1:10.2.1+ds-1ubuntu21:10.2.1+ds-1ubuntu41:10.2.1+ds-1ubuntu4.21:10.2.1+ds-1ubuntu4.31:10.2.1+ds-1ubuntu4.4 | None known |
qemuopenSUSE:Tumbleweed | before 11.1.2-1.1 | 11.1.2-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | abraxas/qemu-xhci-complete-uaf | 2026-10-17 |
What each source reports
OSVopenSUSE-SU-2026:12088-1No score
qemu-11.1.2-1.1 on GA media
These are all security issues fixed in the qemu-11.1.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12088-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-17588No score
[hw/usb/hcd-xhci: Set reentrancy guard in timer functions]
- Record
UBUNTU-CVE-2026-17588- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| first indexed | OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
This page doesn't list everything
Left out here: 213 versions. The JSON record has them.