ELSA-2026-500220
- ULN >
- Oracle Linux Errata repository >
- ELSA-2026-500220
ELSA-2026-500220 - qemu-kvm security update
| Type: | SECURITY |
| Impact: | MODERATE |
| Release Date: | 2026-08-19 |
Description
[7.2.0-42.el9]
- migration: Enable multifd VFIO device state transfer by default for Exadata (Maciej S. Szmigiero) [Orabug: 39783645]
- vfio/migration: Add x-migration-load-config-after-iter VFIO property (Maciej S. Szmigiero) [Orabug: 39783615]
- tests/9p: add 3 xattr FID limit test cases (local fs driver) (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- tests/9p: add 3 xattr FID limit test cases (synth fs driver) (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- tests/9p: add virtio_9p_add_synth_driver_args() test client function (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- tests/9p: increase P9_MAX_SIZE for test client (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- hw/9pfs: add xattr count query interface to fs synth driver (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- hw/9pfs: enable xattr (mockup) support for synth fs driver (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- tests/9p: add Txattrcreate / Rxattrcreate test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- tests/9p: add Tclunk / Rclunk test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- tests/9p: add Tread / Rread test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- qemu-options: document 9pfs max_xattr option (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- hw/9pfs: add max_xattr option (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- hw/9pfs: add xattr FID limit to prevent memory exhaustion (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- hw/9pfs: cap Treaddir allocation (CVE-2026-9238) (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- 9pfs/xen: implement response_buffer_size callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- 9pfs/virtio: implement response_buffer_size callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- hw/9pfs: add response_buffer_size transport callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- hw/9pfs: cap negotiated msize to transport limit (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- 9pfs/xen: implement msize_limit callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- 9pfs/virtio: implement msize_limit callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- hw/9pfs: add msize_limit transport callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238}
- 9pfs: fix missing rename lock in v9fs_co_readdir_many (CVE-2026-48004) (sin99xx) [Orabug: 39478419] {CVE-2026-48004}
- tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348}
- libvduse: fix buffer overflow in vduse_queue_read_indirect_desc() (Stefano Garzarella) [Orabug: 39447322] {CVE-2026-6425}
- libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc() (Stefano Garzarella) [Orabug: 39447322] {CVE-2026-6425}
- virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914) (Stefan Hajnoczi) [Orabug: 39522394] {CVE-2026-48914}
[7.2.0-41.el9]
- hw/virtio/virtio-crypto: validate asym session key size (Miguel Luis) [Orabug: 39480090]
- virtio-net: validate RSS queue selectors in parser (Miguel Luis) [Orabug: 39480096]
- ui: fix validation of VNC extended clipboard data length (Heechan Kang) [Orabug: 39442988] {CVE-2026-8343}
- ui/vnc: fix OOB read updating VNC update frequency stats (Daniel P. Berrange) [Orabug: 39447326] {CVE-2026-48003}
- ui/vnc: fix OOB write in lossy rect worker code (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002}
- ui/vnc: fix OOB write in VNC stats array (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002}
- tests/unit/test-blockjob: Disable complete_in_standby test (Peter Maydell) [Orabug: 39447937]
- virtio-scsi: reset SCSI devices from main loop thread (Stefan Hajnoczi) [Orabug: 39296894]
- dma-helpers: prevent dma_blk_cb() vs dma_aio_cancel() race (Stefan Hajnoczi) [Orabug: 39296894]
- scsi: protect req->aiocb with AioContext lock (Stefan Hajnoczi) [Orabug: 39296894]
- virtio-iommu: add error check before assert (Manos Pitsidianakis) [Orabug: 39447244]
- hw/virtio-iommu: Fix potential OOB access in virtio_iommu_handle_command() (Eric Auger) [Orabug: 39447244]
- thread-pool: Allow at least 1 thread in thread_pool_adjust_max_threads_to_work() (Maciej S. Szmigiero) [Orabug: 39429151]
- lsi53c895a: keep a reference to the device while SCRIPTS execute (Paolo Bonzini) [Orabug: 37517793] {CVE-2024-6519}
- hw/scsi/lsi53c895a: fix memory leak in lsi_scsi_realize() (Zheng Huang) [Orabug: 37517793] {CVE-2024-6519}
- hw/scsi/lsi53c895a: bump instruction limit in scripts processing to fix regression (Fiona Ebner) [Orabug: 37517793] {CVE-2024-6519}
- hw/scsi/lsi53c895a: add timer to scripts processing (Sven Schnelle) [Orabug: 37517793] {CVE-2024-6519}
- hw/scsi/lsi53c895a: add missing decrement of reentrancy counter (Sven Schnelle) [Orabug: 39429302]
- hw/i386/amd_iommu: Move IOAPIC memory region initialization to the end (Sairaj Kodilkar) [Orabug: 39422329]
- virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare (Paolo Bonzini) [Orabug: 39414097] {CVE-2026-5763}
- softmmu: Support concurrent bounce buffers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
- system/physmem: Per-AddressSpace bounce buffering (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
- system/physmem: Propagate AddressSpace to MapClient helpers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
- hw/pci: Ignore config-space data between 0x804-0x807 (Joao Martins)
- hostmem-memfd: Documentation for memory-backend-memfd 'keep' property (William Roche) [Orabug: 38769121]
- hostmem-memfd: Wire up MFD_MF_KEEP_UE_MAPPED via 'keep' property (William Roche) [Orabug: 38769121]
[7.2.0-38.el9]
- multifd: Save number of pages for batch context pages (Elena Ufimtseva) [Orabug: 39001115]
- migration: Introduce MigrateCleanupCtx for cleanup thread (Elena Ufimtseva) [Orabug: 39001115]
- migration: Move qemu_mmap_node/qemu_munmap_node (Elena Ufimtseva) [Orabug: 39001115]
- multifd: Allocate a large chunk for pages->cached (Elena Ufimtseva) [Orabug: 39214550]
- migration: Defer multifd and hash cache cleanup (Elena Ufimtseva) [Orabug: 39215178]
- multifd: Split multifd_send_shutdown (Elena Ufimtseva) [Orabug: 39215178]
- migration: Rename background cleanup thread and mutex/cond (Elena Ufimtseva) [Orabug: 39215178]
Related CVEs
| CVE-2024-6519 |
| CVE-2024-8612 |
| CVE-2026-48002 |
| CVE-2026-48003 |
| CVE-2026-48004 |
| CVE-2026-48914 |
| CVE-2026-5763 |
| CVE-2026-6425 |
| CVE-2026-8343 |
| CVE-2026-8348 |
| CVE-2026-9238 |
Updated Packages
| Release/Architecture | Filename | sha256 | Superseded By Advisory | Channel Label |
| Oracle Linux 9 (aarch64) | qemu-kvm-7.2.0-42.el9.src.rpm | d4cc38faf01e5d91df5ad8087aa15715eefb938aa2aed68c9a6249d20d75a0a9 | - | ol9_aarch64_kvm_utils |
| qemu-guest-agent-7.2.0-42.el9.aarch64.rpm | 902b7bd18c5bac40090ad2fb36d0af510afa1069de677511c9ed2b83f05e62f0 | - | ol9_aarch64_kvm_utils | |
| qemu-img-7.2.0-42.el9.aarch64.rpm | 570db45323362c7df10def5063fe1adf9ac7332fd3bc2b559811c1630a1eebb6 | - | ol9_aarch64_kvm_utils | |
| qemu-kvm-7.2.0-42.el9.aarch64.rpm | 25f633a18d96af71202d3b8326dbb23537935674d4dd80c69c5439488b9c2c87 | - | ol9_aarch64_kvm_utils | |
| qemu-kvm-block-curl-7.2.0-42.el9.aarch64.rpm | b6a2cb3e4f31452e4c6431e0692a1e611d0f18ea2e77d1107badb9372895a426 | - | ol9_aarch64_kvm_utils | |
| qemu-kvm-block-iscsi-7.2.0-42.el9.aarch64.rpm | 62d3a6bb5c924cdaaccd3ba1cd59f96933c2821f683fcb5ada6587274d8ab66b | - | ol9_aarch64_kvm_utils | |
| qemu-kvm-block-rbd-7.2.0-42.el9.aarch64.rpm | 860c542fba4c2c6a7a1de24fd819f1c023e4d163ef76dda3f2e8820165833fe5 | - | ol9_aarch64_kvm_utils | |
| qemu-kvm-block-ssh-7.2.0-42.el9.aarch64.rpm | 351534a949328eca5f97dcd0f2040a0e8a355d5fbf0c07ee852fbab846ef3b64 | - | ol9_aarch64_kvm_utils | |
| qemu-kvm-common-7.2.0-42.el9.aarch64.rpm | 7d58a11c82ec62fd4bf7f23b7fcd67555f39a975511b1cae610785bd1682ce4f | - | ol9_aarch64_kvm_utils | |
| qemu-kvm-core-7.2.0-42.el9.aarch64.rpm | db8747eab314e227dac0cc8b6cf12ef1190caeaaf0aa5c216517a35773b74d32 | - | ol9_aarch64_kvm_utils | |
| qemu-kvm-device-usb-host-7.2.0-42.el9.aarch64.rpm | 844f09bd83e0406ee87038b7b675a8c5ec4b83259b0b6b4d1406c6aadffc4e40 | - | ol9_aarch64_kvm_utils | |
| qemu-virtiofsd-7.2.0-42.el9.aarch64.rpm | 6c7834a541f0551d3cc65a1cad171b63769938ff8d0d030a4d691b6a68202964 | - | ol9_aarch64_kvm_utils | |
| Oracle Linux 9 (x86_64) | qemu-kvm-7.2.0-42.el9.src.rpm | d4cc38faf01e5d91df5ad8087aa15715eefb938aa2aed68c9a6249d20d75a0a9 | - | ol9_x86_64_kvm_utils |
| qemu-guest-agent-7.2.0-42.el9.x86_64.rpm | 847563701b2696e501cefdadb000f07f2b812dbfb53e0f1886e983a2cce5cda7 | - | ol9_x86_64_kvm_utils | |
| qemu-img-7.2.0-42.el9.x86_64.rpm | 22e32744c4e2260f08edbad40b51c19e75c69aed2a1fe854b54bb3ae39c98174 | - | ol9_x86_64_kvm_utils | |
| qemu-kvm-7.2.0-42.el9.x86_64.rpm | d269c1813cba746a95d48710f9e19bce1c7167f1f7b5cf954e37fceb60ed53a9 | - | ol9_x86_64_kvm_utils | |
| qemu-kvm-block-curl-7.2.0-42.el9.x86_64.rpm | 0b0d1e0d10f5ffdf6510653449866467cf2a81e2b9a386a57324b43af7ec7946 | - | ol9_x86_64_kvm_utils | |
| qemu-kvm-block-iscsi-7.2.0-42.el9.x86_64.rpm | 04887a49c657aa834832c61056e8670d0f6fd8a645ec755e831071b48c1d785c | - | ol9_x86_64_kvm_utils | |
| qemu-kvm-block-rbd-7.2.0-42.el9.x86_64.rpm | 27b58e34b6e32425717f39e8e9ec1ed3d2e3c4755b486a9dafa8733a384394f0 | - | ol9_x86_64_kvm_utils | |
| qemu-kvm-block-ssh-7.2.0-42.el9.x86_64.rpm | 87df679c07027f83054905b17927178505c6e36a19a67421fb3d31c8c75b1014 | - | ol9_x86_64_kvm_utils | |
| qemu-kvm-common-7.2.0-42.el9.x86_64.rpm | 611ab7562f3e43e3af96b92445f9aad6ca72805c7a372ed18763675a91eb47e3 | - | ol9_x86_64_kvm_utils | |
| qemu-kvm-core-7.2.0-42.el9.x86_64.rpm | 1eb1dfe950545184c7a13b90d9d2d054fcf0639ee8c3dcf6509e2f471ef7486a | - | ol9_x86_64_kvm_utils | |
| qemu-kvm-device-usb-host-7.2.0-42.el9.x86_64.rpm | b9cefb3d8e6248b89cb63594773971c52f8e9d3ba549457e24b5f6a8f7bccf00 | - | ol9_x86_64_kvm_utils | |
| qemu-virtiofsd-7.2.0-42.el9.x86_64.rpm | 479ad7305a9455a977b8ac2b51aab3ff8fcbe4953678dcab4bb81d82325602b6 | - | ol9_x86_64_kvm_utils | |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team
