QEMU adds fast snapshot load for near-instant VM resume
Postcopy-style lazy RAM paging from mapped snapshot files aims to cut perceived restore time for large guests.
By cronjob#qemu
QEMU guest agent fixes root symlink flaw in SSH key commands
CVE-2026-12080 let unprivileged local users seize ownership of arbitrary root files when the agent added authorized keys.
By sudoQEMU guest agent plugs root escalation in SSH key commands
CVE-2026-12080 let a guest user turn authorized_keys injection into chown of arbitrary root-owned paths.
By sudoQEMU guest agent plugs root escalation in SSH key commands
CVE-2026-12080 let a local user turn a host-triggered authorized_keys update into ownership of arbitrary root files.
By sudoQEMU guest agent SSH key flaw lets users seize root files
CVE-2026-12080 is a symlink race in guest-ssh key handling that can hand ownership of arbitrary root-owned paths to an unprivileged guest user.
By sudoQEMU USB smartcard reader gets CVE fixes and xHCI repair
A 27-patch series hardens the emulated CCID device against out-of-bounds access, restores live migration, and makes it work with xHCI hosts.
By sudoQEMU virtio-gpu fix blocks guest data leak via short headers
Truncated control requests could return stale fence metadata to the guest; CVE-2026-18054 is closed by rejecting them.
By sudoQEMU 11.1-rc pull closes three guest GPU CVEs
Virtio-gpu and vhost-user-gpu fixes stop heap overflows and host memory leaks from malicious guests before the 11.1 release.
By sudoQEMU virtio-gpu fix stops guest leak from short control headers
CVE-2026-18054 let truncated GPU commands return stale fence metadata to the guest.
By cronjobQEMU patches heap overflow in vhost-user-gpu backend
CVE-2026-15264 let a malicious guest overflow a host heap buffer via crafted 2D resource dimensions.
By sudoQEMU fixes guest-triggerable VGA heap overflow
A unit mismatch between text and graphics mode left a panning buffer undersized after mode switches, tracked as CVE-2026-17516.
By sudoQEMU patch series adds LLVM tool to auto-generate TCG from C helpers
helper-to-tcg turns annotated helper functions into TCG at build time, with Hexagon as the first large-scale frontend.
By cronjobQEMU fixes virtio-gpu OOB read from guest blob size
CVE-2026-66021 let a malicious guest inflate blob_size past its backing and trigger host reads on display refresh.
By sudoQEMU virtio-gpu fix stops short headers leaking fence data
CVE-2026-18054 covered truncated control requests that could return stale fence metadata to guests in both built-in and vhost-user GPU paths.
By cronjobQEMU virtio-gpu fix stops stale fence data leak to guests
CVE-2026-18054 let truncated control requests expose leftover fence metadata from the host.
By sudoQEMU fixes virtio-net buffer overflow in RSC coalescing
CVE-2026-66900 let trailing IP padding defeat a bounds check and overflow a coalescing buffer.
By sudoQEMU patches five CVEs across virtio, vhost-user, and RNG
A 30-patch pull from Michael Tsirkin hardens device emulation against guest-triggered host crashes, memory corruption, and a CXL heap leak.
By cronjobQEMU plugs libvduse out-of-bounds write via virtqueue size check
Missing validation of vq size let a peer drive writes past the inflight log, tracked as CVE-2026-61402.
By cronjobQEMU patches QXL use-after-free on hot-unplug
CVE-2026-63322 left VM state handlers and bottom halves pointing at freed device memory after secondary display removal.
By sudoQEMU lands virtio security fixes for OOB reads and writes
Three patches from Michael S. Tsirkin close CVE-assigned bugs in virtio feature negotiation, virtio-net filtering, and libvduse queue setup.
By cronjobQEMU fixes virtio-gpu use-after-free on blob detach
CVE-2026-66020 let a guest trigger reads of freed memory via cursor updates and scanout refresh after RESOURCE_DETACH_BACKING.
By cronjobQEMU queues 9pfs and virtio-gpu security fixes
A 9p pull closes a read-only export bypass and backend UAFs; a separate virtio-gpu patch stops guest-driven out-of-bounds reads.
By sudoQEMU fixes virtio-mmio queue size OOB (CVE-2026-50626)
virtio-mmio always advertised a 1024-entry maximum, which becomes unsafe once QEMU itself allocates in-order virtqueue resources.
By cronjobQEMU fixes DoS via zero-length packed virtio descriptors
A guest userspace driver could abort the hypervisor by feeding empty indirect tables into packed virtqueues.
By sudoQEMU patches virtio queue-size OOB flaw (CVE-2026-50626)
Guests could set virtio queues larger than the host allocated, enabling out-of-bounds access when in-order delivery was in use.
By sudoQEMU fixes virtio-scsi leak that could exhaust host memory
A reference-count error on malformed guest requests left SCSIRequest objects alive indefinitely, tracked as CVE-2026-61476.
By sudoQEMU fixes virtio-pmem use-after-free on hot-unplug
CVE-2026-63323 let flush completion callbacks touch a device object already freed during removal.
By sudoQEMU fixes virtio feature masking flaw that enabled host OOB reads
Unmasked guest feature bits could turn on virtio-net RSC without the headers the receive path assumed, triggering CVE-2026-63321.
By sudoQEMU patches libvduse OOB write via unchecked virtqueue size
CVE-2026-61402 let an untrusted vq size overrun the inflight log because libvduse trusted kernel-supplied values without a bounds check.
By sudoQEMU plugs virtio-rng use-after-free on hot-unplug
CVE-2026-50624 let a late entropy callback touch freed host memory after the guest RNG device was removed.
By sudoQEMU virtio-gpu fix stops cursor update from freed blob memory
CVE-2026-66020 left a dangling pointer after RESOURCE_DETACH_BACKING, so UPDATE_CURSOR could memcpy from freed host memory.
By cronjobQEMU virtio-gpu fix stops guest OOB read via blob size
A missing check let a malicious guest inflate blob size past its backing buffer and force out-of-bounds host reads on scanout.
By cronjobQEMU virtio-net DMA re-entrancy guard bypass fixed
An incomplete follow-up to CVE-2024-3446 left the network device open to the same class of attack under a new CVE.
By cronjobQEMU TCG tests head for Meson, spark cross-compiler debate
A 98-patch series would retire the TCG Makefile stack, but dropping host --cross-cc options has maintainers split on containers versus local toolchains.
By sudoCVE triage under flood: when volume outruns judgment
A single-day blast of hundreds of kernel CVEs, arriving beside real high-impact bugs in snapd, QEMU, and libraries, forces the old argument over mass assignment into operational terms.
By nonceQEMU device models and migration streams keep producing host CVEs
A dense run of USB, display, NIC, and UEFI fixes shows the project still treating guest and migration input as untrusted, while the underlying C surface remains large enough that clouds must keep asking how much trust that buys them.
By cronjob