Oracle Errata System Oracle Linux 5.11 2026-08-24T08:59:43 Oracle Linux 9 [7.2.0-42.el9] - migration: Enable multifd VFIO device state transfer by default for Exadata (Maciej S. Szmigiero) [Orabug: 39783645] - vfio/migration: Add x-migration-load-config-after-iter VFIO property (Maciej S. Szmigiero) [Orabug: 39783615] - tests/9p: add 3 xattr FID limit test cases (local fs driver) (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - tests/9p: add 3 xattr FID limit test cases (synth fs driver) (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - tests/9p: add virtio_9p_add_synth_driver_args() test client function (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - tests/9p: increase P9_MAX_SIZE for test client (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - hw/9pfs: add xattr count query interface to fs synth driver (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - hw/9pfs: enable xattr (mockup) support for synth fs driver (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - tests/9p: add Txattrcreate / Rxattrcreate test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - tests/9p: add Tclunk / Rclunk test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - tests/9p: add Tread / Rread test client functions (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - qemu-options: document 9pfs max_xattr option (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - hw/9pfs: add max_xattr option (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - hw/9pfs: add xattr FID limit to prevent memory exhaustion (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - hw/9pfs: cap Treaddir allocation (CVE-2026-9238) (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238} - 9pfs/xen: implement response_buffer_size callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238} - 9pfs/virtio: implement response_buffer_size callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238} - hw/9pfs: add response_buffer_size transport callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238} - hw/9pfs: cap negotiated msize to transport limit (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238} - 9pfs/xen: implement msize_limit callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238} - 9pfs/virtio: implement msize_limit callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238} - hw/9pfs: add msize_limit transport callback (Christian Schoenebeck) [Orabug: 39601986] {CVE-2026-9238} - 9pfs: fix missing rename lock in v9fs_co_readdir_many (CVE-2026-48004) (sin99xx) [Orabug: 39478419] {CVE-2026-48004} - tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset (Christian Schoenebeck) [Orabug: 39636027] {CVE-2026-8348} - libvduse: fix buffer overflow in vduse_queue_read_indirect_desc() (Stefano Garzarella) [Orabug: 39447322] {CVE-2026-6425} - libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc() (Stefano Garzarella) [Orabug: 39447322] {CVE-2026-6425} - virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914) (Stefan Hajnoczi) [Orabug: 39522394] {CVE-2026-48914} [7.2.0-41.el9] - hw/virtio/virtio-crypto: validate asym session key size (Miguel Luis) [Orabug: 39480090] - virtio-net: validate RSS queue selectors in parser (Miguel Luis) [Orabug: 39480096] - ui: fix validation of VNC extended clipboard data length (Heechan Kang) [Orabug: 39442988] {CVE-2026-8343} - ui/vnc: fix OOB read updating VNC update frequency stats (Daniel P. Berrange) [Orabug: 39447326] {CVE-2026-48003} - ui/vnc: fix OOB write in lossy rect worker code (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002} - ui/vnc: fix OOB write in VNC stats array (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002} - tests/unit/test-blockjob: Disable complete_in_standby test (Peter Maydell) [Orabug: 39447937] - virtio-scsi: reset SCSI devices from main loop thread (Stefan Hajnoczi) [Orabug: 39296894] - dma-helpers: prevent dma_blk_cb() vs dma_aio_cancel() race (Stefan Hajnoczi) [Orabug: 39296894] - scsi: protect req->aiocb with AioContext lock (Stefan Hajnoczi) [Orabug: 39296894] - virtio-iommu: add error check before assert (Manos Pitsidianakis) [Orabug: 39447244] - hw/virtio-iommu: Fix potential OOB access in virtio_iommu_handle_command() (Eric Auger) [Orabug: 39447244] - thread-pool: Allow at least 1 thread in thread_pool_adjust_max_threads_to_work() (Maciej S. Szmigiero) [Orabug: 39429151] - lsi53c895a: keep a reference to the device while SCRIPTS execute (Paolo Bonzini) [Orabug: 37517793] {CVE-2024-6519} - hw/scsi/lsi53c895a: fix memory leak in lsi_scsi_realize() (Zheng Huang) [Orabug: 37517793] {CVE-2024-6519} - hw/scsi/lsi53c895a: bump instruction limit in scripts processing to fix regression (Fiona Ebner) [Orabug: 37517793] {CVE-2024-6519} - hw/scsi/lsi53c895a: add timer to scripts processing (Sven Schnelle) [Orabug: 37517793] {CVE-2024-6519} - hw/scsi/lsi53c895a: add missing decrement of reentrancy counter (Sven Schnelle) [Orabug: 39429302] - hw/i386/amd_iommu: Move IOAPIC memory region initialization to the end (Sairaj Kodilkar) [Orabug: 39422329] - virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare (Paolo Bonzini) [Orabug: 39414097] {CVE-2026-5763} - softmmu: Support concurrent bounce buffers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612} - system/physmem: Per-AddressSpace bounce buffering (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612} - system/physmem: Propagate AddressSpace to MapClient helpers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612} - hw/pci: Ignore config-space data between 0x804-0x807 (Joao Martins) - hostmem-memfd: Documentation for memory-backend-memfd 'keep' property (William Roche) [Orabug: 38769121] - hostmem-memfd: Wire up MFD_MF_KEEP_UE_MAPPED via 'keep' property (William Roche) [Orabug: 38769121] [7.2.0-38.el9] - multifd: Save number of pages for batch context pages (Elena Ufimtseva) [Orabug: 39001115] - migration: Introduce MigrateCleanupCtx for cleanup thread (Elena Ufimtseva) [Orabug: 39001115] - migration: Move qemu_mmap_node/qemu_munmap_node (Elena Ufimtseva) [Orabug: 39001115] - multifd: Allocate a large chunk for pages->cached (Elena Ufimtseva) [Orabug: 39214550] - migration: Defer multifd and hash cache cleanup (Elena Ufimtseva) [Orabug: 39215178] - multifd: Split multifd_send_shutdown (Elena Ufimtseva) [Orabug: 39215178] - migration: Rename background cleanup thread and mutex/cond (Elena Ufimtseva) [Orabug: 39215178] MODERATE Copyright 2026 Oracle, Inc. CVE-2024-6519 CVE-2024-8612 CVE-2026-48002 CVE-2026-48003 CVE-2026-48004 CVE-2026-48914 CVE-2026-5763 CVE-2026-6425 CVE-2026-8343 CVE-2026-8348 CVE-2026-9238 cpe:/a:oracle:linux:9::kvm_utils