QEMU UEFI security fixes and Kubernetes client CVE

Security work on QEMU firmware emulation and a Kubernetes client advisory dominated databases and infrastructure traffic. A QEMU stable branch freeze also captured assorted backports.

QEMU pulls UEFI variable service CVE fixes

Gerd Hoffmann sent a six-patch series for QEMU hw/uefi that maintainers pulled as firmware 20260722. The changes add buffer length sanity checks, remove a debug print, make the SetupMode variable read-only, and correct endless-loop, storage-accounting and migration problems, closing multiple CVEs including CVE-2026-58581, CVE-2026-58582 and CVE-2026-16288 in OVMF variable-policy handling. Operators running UEFI guests should take the updates to reduce guest-triggered attack surface.

Kubernetes Java Client path-traversal advisory

A security advisory announced CVE-2026-15687 against the Kubernetes Java client. The low-severity flaw permits path traversal via the non-tar code path inside copyDirectoryFromPod. Projects that use the client to copy directories out of pods need to evaluate exposure and apply the fix.

QEMU intel-hda DMA paths further restricted

A patch for hw/audio/intel-hda extends the CVE-2021-3611 DMA-memory restriction to three previously missed engine paths. The change prevents guest-triggered MMIO reentry through the emulated audio device. It hardens residual attack surface left by the earlier mitigation.

QEMU 11.0.3 stable queue frozen

The 127-patch round-up for QEMU stable 11.0.3 froze on 2026-07-22. Backports include security fixes for USB, XHCI and QXL plus routine bug fixes. Downstream packagers can now base releases on the frozen set.