{ "cves": [ "CVE-2024-6519", "CVE-2024-8612", "CVE-2026-48002", "CVE-2026-48003", "CVE-2026-48004", "CVE-2026-48914", "CVE-2026-5763", "CVE-2026-6425", "CVE-2026-8343", "CVE-2026-8348", "CVE-2026-9238" ], "cvss": 0.0, "database_specific": { "severity": "MODERATE" }, "description": "[7.2.0-42.el9]\n- migration: Enable multifd VFIO device state transfer by default for Exadata (Maciej S. Szmigiero) [Orabug: 39783645]\n- vfio/migration: Add x-migration-load-config-after-iter VFIO property (Maciej S. Szmigiero) [Orabug: 39783615]\n- tests/9p: add 3 xattr FID limit test cases (local fs driver) (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- tests/9p: add 3 xattr FID limit test cases (synth fs driver) (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- tests/9p: add virtio_9p_add_synth_driver_args() test client function (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- tests/9p: increase P9_MAX_SIZE for test client (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- hw/9pfs: add xattr count query interface to fs synth driver (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- hw/9pfs: enable xattr (mockup) support for synth fs driver (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- tests/9p: add Txattrcreate / Rxattrcreate test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- tests/9p: add Tclunk / Rclunk test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- tests/9p: add Tread / Rread test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- qemu-options: document 9pfs max_xattr option (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- hw/9pfs: add max_xattr option (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- hw/9pfs: add xattr FID limit to prevent memory exhaustion (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- hw/9pfs: cap Treaddir allocation (CVE-2026-9238) (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}\n- 9pfs/xen: implement response_buffer_size callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}\n- 9pfs/virtio: implement response_buffer_size callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}\n- hw/9pfs: add response_buffer_size transport callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}\n- hw/9pfs: cap negotiated msize to transport limit (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}\n- 9pfs/xen: implement msize_limit callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}\n- 9pfs/virtio: implement msize_limit callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}\n- hw/9pfs: add msize_limit transport callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}\n- 9pfs: fix missing rename lock in v9fs_co_readdir_many (CVE-2026-48004) (sin99xx) [Orabug: 39478419] {CVE-2026-48004}\n- tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}\n- libvduse: fix buffer overflow in vduse_queue_read_indirect_desc() (Stefano Garzarella) [Orabug: 39447322] {CVE-2026-6425}\n- libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc() (Stefano Garzarella) [Orabug: 39447322] {CVE-2026-6425}\n- virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914) (Stefan Hajnoczi) [Orabug: 39522394] {CVE-2026-48914}\n\n[7.2.0-41.el9]\n- hw/virtio/virtio-crypto: validate asym session key size (Miguel Luis) [Orabug: 39480090]\n- virtio-net: validate RSS queue selectors in parser (Miguel Luis) [Orabug: 39480096]\n- ui: fix validation of VNC extended clipboard data length (Heechan Kang) [Orabug: 39442988] {CVE-2026-8343}\n- ui/vnc: fix OOB read updating VNC update frequency stats (Daniel P. Berrange) [Orabug: 39447326] {CVE-2026-48003}\n- ui/vnc: fix OOB write in lossy rect worker code (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002}\n- ui/vnc: fix OOB write in VNC stats array (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002}\n- tests/unit/test-blockjob: Disable complete_in_standby test (Peter Maydell) [Orabug: 39447937]\n- virtio-scsi: reset SCSI devices from main loop thread (Stefan Hajnoczi) [Orabug: 39296894]\n- dma-helpers: prevent dma_blk_cb() vs dma_aio_cancel() race (Stefan Hajnoczi) [Orabug: 39296894]\n- scsi: protect req-aiocb with AioContext lock (Stefan Hajnoczi) [Orabug: 39296894]\n- virtio-iommu: add error check before assert (Manos Pitsidianakis) [Orabug: 39447244]\n- hw/virtio-iommu: Fix potential OOB access in virtio_iommu_handle_command() (Eric Auger) [Orabug: 39447244]\n- thread-pool: Allow at least 1 thread in thread_pool_adjust_max_threads_to_work() (Maciej S. Szmigiero) [Orabug: 39429151]\n- lsi53c895a: keep a reference to the device while SCRIPTS execute (Paolo Bonzini) [Orabug: 37517793] {CVE-2024-6519}\n- hw/scsi/lsi53c895a: fix memory leak in lsi_scsi_realize() (Zheng Huang) [Orabug: 37517793] {CVE-2024-6519}\n- hw/scsi/lsi53c895a: bump instruction limit in scripts processing to fix regression (Fiona Ebner) [Orabug: 37517793] {CVE-2024-6519}\n- hw/scsi/lsi53c895a: add timer to scripts processing (Sven Schnelle) [Orabug: 37517793] {CVE-2024-6519}\n- hw/scsi/lsi53c895a: add missing decrement of reentrancy counter (Sven Schnelle) [Orabug: 39429302]\n- hw/i386/amd_iommu: Move IOAPIC memory region initialization to the end (Sairaj Kodilkar) [Orabug: 39422329]\n- virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare (Paolo Bonzini) [Orabug: 39414097] {CVE-2026-5763}\n- softmmu: Support concurrent bounce buffers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}\n- system/physmem: Per-AddressSpace bounce buffering (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}\n- system/physmem: Propagate AddressSpace to MapClient helpers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}\n- hw/pci: Ignore config-space data between 0x804-0x807 (Joao Martins)\n- hostmem-memfd: Documentation for memory-backend-memfd 'keep' property (William Roche) [Orabug: 38769121]\n- hostmem-memfd: Wire up MFD_MF_KEEP_UE_MAPPED via 'keep' property (William Roche) [Orabug: 38769121]\n\n[7.2.0-38.el9]\n- multifd: Save number of pages for batch context pages (Elena Ufimtseva) [Orabug: 39001115]\n- migration: Introduce MigrateCleanupCtx for cleanup thread (Elena Ufimtseva) [Orabug: 39001115]\n- migration: Move qemu_mmap_node/qemu_munmap_node (Elena Ufimtseva) [Orabug: 39001115]\n- multifd: Allocate a large chunk for pages-cached (Elena Ufimtseva) [Orabug: 39214550]\n- migration: Defer multifd and hash cache cleanup (Elena Ufimtseva) [Orabug: 39215178]\n- multifd: Split multifd_send_shutdown (Elena Ufimtseva) [Orabug: 39215178]\n- migration: Rename background cleanup thread and mutex/cond (Elena Ufimtseva) [Orabug: 39215178]", "id": "ELSA-2026-500220", "ovalId": "oval:com.oracle.elsa:def:2026500220", "source": "oracle_linux", "title": "ELSA-2026-500220: qemu-kvm security update (MODERATE)", "url": "https://linux.oracle.com/errata/ELSA-2026-500220.html" }