Hi, The following vulnerability was published for qemu. CVE-2026-48914[0]: | A flaw was found in QEMU's virtio-blk device. The issue arises | because the device does not properly validate the size of input | descriptors before writing data. A malicious guest with high | privileges could exploit this vulnerability by submitting a | malformed virtio-blk SCSI request, leading to an out-of-bounds write | in the host heap memory and a potential denial of service (DoS) for | the QEMU process. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-48914 https://www.cve.org/CVERecord?id=CVE-2026-48914 [1] https://bugzilla.redhat.com/show_bug.cgi?id=2488283 [2] https://gitlab.com/qemu-project/qemu/-/commit/aeea0c2804c42f24915467a1e4c70e649e39b8e0 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
We believe that the bug you reported is fixed in the latest version of
qemu, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1139923@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated qemu package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 28 Jun 2026 08:03:05 +0300
Source: qemu
Architecture: source
Version: 1:11.0.2+ds-1
Distribution: unstable
Urgency: medium
Maintainer: Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Closes: 1139923
Changes:
qemu (1:11.0.2+ds-1) unstable; urgency=medium
.
[ Michael Tokarev ]
* new upstream stable/bugfix release:
- Update version for 11.0.2 release
- linux-user: Fix AT_PHDR when program headers are relocated
into their own segment
- hw/pci: Replace assert with bounds check and return
- ppc/pnv_phb3: Error out on invalid config access
- linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
- linux-user/xtensa: save/restore FP registers across signal delivery
- target/xtensa: add cpu_set_fcr/fsr helpers to sync fp_status
- target/arm/hvf: Stop pre-allocating cpreg_vmstate arrays
- ui/sdl2: Set GL ES profile before creating initial GL context
- ui/sdl2: Explicitly specify EGL platform
- hw/9pfs: reject . and .. in Twstat rename
- hw/9pfs: fix abort due to illegal name with Twstat rename
- gdbstub: Update x86 control register bits
- target/i386: apply mod to immediate count of an RCL/RCR operation
- hw/uefi: fix parse_hexstr
(Closes: CVE-2026-48915)
- target/riscv: mask vxrm csrw write to the low 2 bits
- disas/riscv.c: fix inst_length()
- target/riscv/tcg: disable svnapot if satp_mode < sv39
- target/riscv/cpu_helper.c: add PMA access fault
- target/riscv/cpu_helper.c: fault with reserved PTE.PBMT val
- target/riscv/insn_trans/trans_rvzicbo.c.inc: save opcode before helpers
- disas/riscv.c: add 'cbo' insns to disassembler
- target/riscv/csr.c: fix mstatus.UXL reserved value
- target/riscv/csr.c: do not allow mstatus MPV/GVA writes
- target/riscv/tcg: disable svpbmt if satp_mode < sv39
- target/riscv/cpu_helper.c: allow LOAD_ADDR_MIS promotion to AMO fault
- virtio: Allow to fill a whole virtqueue in order
- amd_iommu: Reject non-decreasing NextLevel in fetch_pte()
- amd_iommu: Follow root pointer before page walk and use 1-based levels
- libvduse: fix buffer overflow in vduse_queue_read_indirect_desc()
(Closes: CVE-2026-6425)
- libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()
(Closes: CVE-2026-6425)
- tests/qtest: Add amd-iommu command buffer head wrap test
- amd_iommu: Update command buffer head ptr in MMIO region after wraparound
- amd_iommu: restrict command buffer head/tail ranges to ring size
- linux-user: add preadv2/preadv2
- system/rtc: Fix a possible year-2038 integer overflow problem
- linux-user/strace: add fsmount series of syscalls
- linux-user: implement fsmount(2) series of syscalls
- fpu: Handle all rounding modes in partsN_uncanon_normal
- hw/usb/hcd-ohci: Clean up USBPacket before freeing ISO TD packet
- qed: Don't try to flush during incoming migration
- iotests: test shared mmap for fuse export
- block/export/fuse: set FUSE_DIRECT_IO_ALLOW_MMAP flag to fix regression
- block/export/fuse: use struct fuse_init_in
- qcow2: Fix data loss on zero write with detect-zeroes=unmap
- iotests/046: Test that discard/write_zeroes wait for dependencies
- qcow2: Fix corruption on discard during write with COW
- qemu-io: Add 'aio_discard' command
- virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check
(Closes: #1139923, CVE-2026-48914)
- block/io: fallback to bounce buffer if BLKZEROOUT is not supported
because of alignment
- hw/i3c: fix CMD/data FIFO depth reset values to match real silicon
- s390x/pci: Fix interrupt forwarding disable for interpreted devices
- target/s390x: Make container ids in SysIB_15x 1-based
- lcitool: remove Cirrus CI support
- gitlab: remove x64-freebsd-14-build Cirrus job
- gitlab: add initial MacOS 15 on gitlab runner
- ci: drop cirrus MacOS build
- tests/unit: add test-envlist covering setenv/unsetenv name matching
- util/envlist: fix prefix-match in envlist_unsetenv() name lookup
- 9pfs: fix missing rename lock in v9fs_co_readdir_many
(Closes: CVE-2026-48004)
- tests/9pfs: add deep absolute path test
- tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset
- hw/9pfs: let callers of v9fs_path_sprintf() and v9fs_fix_path()
handle errors
- hw/9pfs: add error handling to v9fs_fix_path()
- hw/9pfs: change V9fsPath.size to size_t and v9fs_path_sprintf()
return type
- hw/9pfs: add NULL check in v9fs_path_is_ancestor()
- linux-user/s390x: restore fpu_status rounding mode from FPC on sigreturn
- linux-user/sh4: restore FP rounding mode on sigreturn
- linux-user/sh4: preserve T/M/Q bits across signal delivery
- linux-user/mips: save/restore FCSR across signal delivery
- linux-user/ppc: restore fp_status from FPSCR on sigreturn
- hw/net/rocker_of_dpa: Avoid unaligned accesses in _of_dpa_flow_match()
- hw/net/rocker_of_dpa: Check group ID pointers are not NULL
- target/arm: SME BFCVT, BFCVTN have "Alternate BFloat16 behaviors"
- target/arm: Don't assert if 64-bit EL2 AT insn sees a Domain fault
- target/arm: Enable REVD for SVE2.1
- vfio/container: Restrict dma_map_file() to shared RAM or RAM devices
- vfio-user: reject zero migration page size capability
- vfio-user: reject zero DMA page size capability
- target/arm: Set correct fp flags for FLOGB when FPCR.AH = 1
- target/arm: Use FPST_A64_F16 for SVE FCVTLT_hs
- target/arm: SVE2 FMAXP, FMINP must honour AH=1
- block/linux-aio: bound ioq_submit() recursion depth
- mc146818rtc: Fix get_guest_rtc_ns() overflow bug
- apic: fix delivery bitmask with modified xAPIC ids
- lsi53c895a: clear tag byte when processing messages
- lsi53c895a: fix use-after-free of cancelled request
- ui: fix validation of VNC extended clipboard data length
(Closes: CVE-2026-8343)
- ui/vnc: fix OOB read updating VNC update frequency stats
(Closes: CVE-2026-48003)
- ui/vnc: fix OOB write in lossy rect worker code
(Closes: CVE-2026-48002)
- ui/vnc: fix OOB write in VNC stats array
(Closes: CVE-2026-48002)
- ui/vnc: fix OOB read access in VNC SASL mechname array
- linux-user/mips64: fix mipsn32 elf_core_copy_regs entry width
- linux-user/mips64: fix elf_core_copy_regs register layout in core files
- target/riscv: Make hpmcounterh return the upper 32-bits
- target/riscv/csr.c: fix read of pmpaddr(0-63) CSRs
- target/riscv: clear mseccfg on reset for all dependent extensions
- target/riscv: Update the local interrupt mask
- target/riscv: Add mseccfg to VMStateDescription
- target/riscv/pmp: Fix integer overflow in TOR and NA4 address computation
- target/riscv: Fix medeleg[11] read-only zero bit for M-mode ECALL
- hw/char: Check interrupt after txctrl register is written
- target/riscv: rvv: Handle source overlap of vector widening reduction
instructions
- target/riscv: Allow mseccfg access based on ext_zicfilp
- hw/riscv/riscv-iommu: Fix Svnapot 64KB pages
- target/riscv: Update MISA.X for non-standard extensions
- target/riscv: Update MISA.C for Zc* extensions
- crypto: fix client side anonymous TLS credentials
* tcg-loongarch64-Fix-cmp_vec-with-TCG_COND_NE.patch
.
[ Miao Wang ]
* tests/test-qemu-user.sh: also test qemu-loong64
* tests/test-qemu-user.sh: skip armhf when page size is large than 4K
Checksums-Sha1:
173359d911e5560b89a5b959a36b64fda788197d 10043 qemu_11.0.2+ds-1.dsc
7b83162c237941bcdfbb3631de732e69ad19d685 38818356 qemu_11.0.2+ds.orig.tar.xz
b6786db584c5fcaa3345f2ed9ea76e1f5fa998e7 129480 qemu_11.0.2+ds-1.debian.tar.xz
c35ed23298262edd4a31a550a72497f8aa281459 8327 qemu_11.0.2+ds-1_source.buildinfo
Checksums-Sha256:
eb43364cb7f89d3275432f64f7574e90194c19e9200a4420361d146e8edab2ea 10043 qemu_11.0.2+ds-1.dsc
1ebd5dabcf4f279a3a9a0a29fe9c068239cff0c2c1f0f0af222e6d7bc8f59a56 38818356 qemu_11.0.2+ds.orig.tar.xz
0ee92e89d5255b640e7f3a72d98061ac62d81043a9dad4032389f6c3edb44269 129480 qemu_11.0.2+ds-1.debian.tar.xz
6e23b69069f2a2d3436b1e6a4d8baab2730a938075ab0630e8bccebfb4c1dfbd 8327 qemu_11.0.2+ds-1_source.buildinfo
Files:
8b266cba6b0b59b5d7800fc6c36ce195 10043 otherosfs optional qemu_11.0.2+ds-1.dsc
bc7b9483bf1471ff926a87ec071552d1 38818356 otherosfs optional qemu_11.0.2+ds.orig.tar.xz
addad74df591d5693142919c66b89a4b 129480 otherosfs optional qemu_11.0.2+ds-1.debian.tar.xz
72634a886e5743768d303aba32a6c4ca 8327 otherosfs optional qemu_11.0.2+ds-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
wsG7BAEBCgBvBYJqQKw/CRCCqkokOx6UeEcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmfkHQpZwUWhar7QXvwVjnYEyEkRP+6yDZra3eptSqdI
sxYhBGSqKrUx1WkDNmv++YKqSiQ7HpR4AAACkBAAj+psYgB+aNSlxPADmzw7B/tV
B7orrlTQUWO45BOaXszSADOCTM611SsbQnRstiYt9T2wByF+Zbi4RSOupKF7ka/B
VwEke8vt0McMMm7dtpxZ5WASXlyl5DJtf0yDaHei75rzs7HPWMaOvm1M1Rv2VFda
zGdrBWflB5urCGntFPSNkhWEmfEgpOU/2Q6rSTCaJbkkwy4qd9tVkmKycjrPTFCI
9hmlx7vEcpSXqSu5+PFM7suQYWyuGuP4GafHdF0bGuKMzQT4Ph0bfe5m7KlB8uw9
k4/YMCcVkaAfKJIv+am9w6Pmmv0qSYcD1AWIweQxQlChPLJk2+rrPLN6+FkOKxKI
+Gh2yoEHqwHa8BkuFn79K6knICn9sPqIxwME/F0xgOF7PDHzXnxvwyObtAL5AqpN
F1wYYPjjNeP/b6zEZBYDmMM0RtwL4TZFFKU5lQv0Y78Qw59rhF0XFOc9Y1RcjBaj
CedDzSVN8c5S//mCxz0s7PKxVRRF6sruRVuX4rKnbv/wtABPEcxt2Am6XYKWfLxM
X+/EvQe1H4NExUL05+HhrWYP3HCuuYg0TrOTpnRy/uxBUYGXuSAEdmrsDR0aXPWj
h/TzfXEXYglDwSR+mmcSkqzSbEclWG1gXGtWTzdEWHN9xJZn0hOjikgQtjEHzLAQ
UH9S6GDctiQp5klOmLo=
=6EwQ
-----END PGP SIGNATURE-----
We believe that the bug you reported is fixed in the latest version of
qemu, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1139923@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated qemu package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 28 Jun 2026 08:33:17 +0300
Source: qemu
Architecture: source
Version: 1:10.0.11+ds-0+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Closes: 1139923
Changes:
qemu (1:10.0.11+ds-0+deb13u1) trixie; urgency=medium
.
* new upstream stable/bugfix release:
- Update version for 10.0.11 release
- linux-user: Fix AT_PHDR when program headers are relocated into their own segment
- hw/pci: Replace assert with bounds check and return
- ppc/pnv_phb3: Error out on invalid config access
- linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
- linux-user/xtensa: save/restore FP registers across signal delivery
- target/xtensa: add cpu_set_fcr/fsr helpers to sync fp_status
- ui/sdl2: Set GL ES profile before creating initial GL context
- hw/9pfs: reject . and .. in Twstat rename
- hw/9pfs: fix abort due to illegal name with Twstat rename
- gdbstub: Update x86 control register bits
- target/i386: apply mod to immediate count of an RCL/RCR operation
- hw/uefi: fix parse_hexstr
(Closes: CVE-2026-48915)
- target/riscv: mask vxrm csrw write to the low 2 bits
- disas/riscv.c: fix inst_length()
- target/riscv/cpu_helper.c: add PMA access fault
- target/riscv/cpu_helper.c: fault with reserved PTE.PBMT val
- target/riscv/insn_trans/trans_rvzicbo.c.inc: save opcode before helpers
- disas/riscv.c: add 'cbo' insns to disassembler
- target/riscv/csr.c: fix mstatus.UXL reserved value
- target/riscv/csr.c: do not allow mstatus MPV/GVA writes
- target/riscv/cpu_helper.c: allow LOAD_ADDR_MIS promotion to AMO fault
- virtio: Allow to fill a whole virtqueue in order
- libvduse: fix buffer overflow in vduse_queue_read_indirect_desc()
(Closes: CVE-2026-6425)
- libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()
(Closes: CVE-2026-6425)
- tests/qtest: Add amd-iommu command buffer head wrap test
- amd_iommu: Update command buffer head ptr in MMIO region after wraparound
- amd_iommu: restrict command buffer head/tail ranges to ring size
- linux-user: add preadv2/preadv2
- system/rtc: Fix a possible year-2038 integer overflow problem
- linux-user/strace: add fsmount series of syscalls
- linux-user: implement fsmount(2) series of syscalls
- fpu: Handle all rounding modes in partsN_uncanon_normal
- hw/usb/hcd-ohci: Clean up USBPacket before freeing ISO TD packet
- qed: Don't try to flush during incoming migration
- qcow2: Fix data loss on zero write with detect-zeroes=unmap
- iotests/046: Test that discard/write_zeroes wait for dependencies
- qcow2: Fix corruption on discard during write with COW
- qemu-io: Add 'aio_discard' command
- virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check
(Closes: #1139923, CVE-2026-48914)
- block/io: fallback to bounce buffer if BLKZEROOUT is not supported because of alignment
- s390x/pci: Fix interrupt forwarding disable for interpreted devices
- target/s390x: Make container ids in SysIB_15x 1-based
- tests/unit: add test-envlist covering setenv/unsetenv name matching
- util/envlist: fix prefix-match in envlist_unsetenv() name lookup
- 9pfs: fix missing rename lock in v9fs_co_readdir_many
(Closes: CVE-2026-48004)
- tests/9pfs: add deep absolute path test
- tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset
- hw/9pfs: let callers of v9fs_path_sprintf() and v9fs_fix_path() handle errors
- hw/9pfs: add error handling to v9fs_fix_path()
- hw/9pfs: change V9fsPath.size to size_t and v9fs_path_sprintf() return type
- hw/9pfs: add NULL check in v9fs_path_is_ancestor()
- hw/9pfs: move G_GNUC_PRINTF to header
- linux-user/s390x: restore fpu_status rounding mode from FPC on sigreturn
- linux-user/sh4: restore FP rounding mode on sigreturn
- linux-user/sh4: preserve T/M/Q bits across signal delivery
- linux-user/mips: save/restore FCSR across signal delivery
- linux-user/ppc: restore fp_status from FPSCR on sigreturn
- hw/net/rocker_of_dpa: Avoid unaligned accesses in _of_dpa_flow_match()
- hw/net/rocker_of_dpa: Check group ID pointers are not NULL
- target/arm: Don't assert if 64-bit EL2 AT insn sees a Domain fault
- target/arm: Set correct fp flags for FLOGB when FPCR.AH = 1
- target/arm: Use FPST_A64_F16 for SVE FCVTLT_hs
- target/arm: SVE2 FMAXP, FMINP must honour AH=1
- block/linux-aio: bound ioq_submit() recursion depth
- mc146818rtc: Fix get_guest_rtc_ns() overflow bug
- apic: fix delivery bitmask with modified xAPIC ids
- lsi53c895a: clear tag byte when processing messages
- lsi53c895a: fix use-after-free of cancelled request
- ui: fix validation of VNC extended clipboard data length
(Closes: CVE-2026-8343)
- ui/vnc: fix OOB read updating VNC update frequency stats
(Closes: CVE-2026-48003)
- ui/vnc: fix OOB write in lossy rect worker code
(Closes: CVE-2026-48002)
- ui/vnc: fix OOB write in VNC stats array
(Closes: CVE-2026-48002)
- ui/vnc: fix OOB read access in VNC SASL mechname array
- target/riscv: clear mseccfg on reset for all dependent extensions
- target/riscv: Update the local interrupt mask
- target/riscv: Add mseccfg to VMStateDescription
- target/riscv: Save stimer and vstimer in CPU vmstate
- target/riscv/pmp: Fix integer overflow in TOR and NA4 address computation
- target/riscv: Fix medeleg[11] read-only zero bit for M-mode ECALL
- hw/char: sifive_uart: Implement txctrl.txen and rxctrl.rxen
- hw/char: sifive_uart: Avoid infinite delay of async xmit function
- target/riscv: Allow mseccfg access based on ext_zicfilp
- hw/riscv/riscv-iommu: Fix Svnapot 64KB pages
- target/riscv: Update MISA.X for non-standard extensions
- target/riscv: Update MISA.C for Zc* extensions
Checksums-Sha1:
38ca31bb05597a02cd3031d078264e4783a8fc98 12560 qemu_10.0.11+ds-0+deb13u1.dsc
fb72faaf7c72f6536b6076364fae4a17caf749e7 39991080 qemu_10.0.11+ds.orig.tar.xz
ddfac3e08bd6ff9d19f2daf9bf6c6309c4b23f09 149948 qemu_10.0.11+ds-0+deb13u1.debian.tar.xz
3033d764ee9479201fceaea6aafa49501679cfd2 8302 qemu_10.0.11+ds-0+deb13u1_source.buildinfo
Checksums-Sha256:
14280e750f809249fe41068b7767c8631f5ee636ece6a50df80c9918d7536581 12560 qemu_10.0.11+ds-0+deb13u1.dsc
c6fbe5322b2b76bbbef583d1d86d0fca433b3a33776cf38ddcb619cb044b61e6 39991080 qemu_10.0.11+ds.orig.tar.xz
695ea56cafcce0c4246662436c359f11c2d4cbb1395157005e4b925d57abafb1 149948 qemu_10.0.11+ds-0+deb13u1.debian.tar.xz
6efe5c3cc306c53b70ea1576e34298a3a1b63b0cd5a7544bc89a27836f0f4c13 8302 qemu_10.0.11+ds-0+deb13u1_source.buildinfo
Files:
ee922ee42e802569ecd30a5d2d7be413 12560 otherosfs optional qemu_10.0.11+ds-0+deb13u1.dsc
9b6e147e73aa8e2dcce9cee9c018fe2f 39991080 otherosfs optional qemu_10.0.11+ds.orig.tar.xz
872d86d9dca9c0ec42c5717906a9b2ef 149948 otherosfs optional qemu_10.0.11+ds-0+deb13u1.debian.tar.xz
39de11669ad5dba3ba782bd3056dd159 8302 otherosfs optional qemu_10.0.11+ds-0+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
wsG7BAEBCgBvBYJqQLJLCRCCqkokOx6UeEcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmfKnbv4RG9fZUs9bxxjrc1PjpkbBrE2e1KA58lf2alF
4RYhBGSqKrUx1WkDNmv++YKqSiQ7HpR4AABJlBAAw5FRedfPYR/mV8Qj9qfq2GHs
YFoHHnvsu9ns8A2UwgAs7Nnk/ChZgZAmL98JQ3BX/B0mRPzr+ba6ZEBDTVywwQ6p
zDBaL9CysZESNKkhQem9pE6wDuM0FNho6KhDHQOC4IJk9BOfv4BpHTOGz0t0b/xn
MebQ9CXszuJnOXz1lCwPFP07LMnKLoW6aIXB+ETK5/q3h/EVsM+kVeZXh1RXURwJ
jemPeFFgLIrm91CD5qTWoE7h3gAQ4J88xHss4bemmo/VtWwCvHnbZpwFVDZIWHSE
pPw/7zH3Rs7+QxV5TN+A/TdeCfjx8n6Ky0GOK2K2R3tSSS+4pQR0cdyjxsBm8tmH
TltyMRrmYVt3HO/+aMspZijtBlZWMqFrA7Y2z9kITrx+18W7SOoc5KstsNkKXR1Y
cYrHfm65yxvDIII433FrD56/tpkuDRbceTyWd1/7k53Yjh9BaW6QQ4CDNAuh9Vsk
AhZX98fQ253oh6GTzFbaLmCq5NACT6hVY133/XV8sfJt+ImqdxPuHO5nq/ZmSGT7
Q4fkrtJypq0hz7OkPLrDIMOs6hX9ZC8YWEoX3LmjXAfdhInkUhN/HTxilH7ql19N
G5nLypGH/XZet3jjSAwWjuHli9SgQNzTJeYIURT9x97wB4UTdYDxyr5yup5IAYbj
OUSSYpqG24lQah9oEB4=
=qOon
-----END PGP SIGNATURE-----