Errata ALT-PU-2026-3760-1: Information
Fixes
Published: Dec. 18, 2025
Modified: March 2, 2026
Modified: March 2, 2026
BDU:2025-16063
Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с использованием памяти после её освобождения, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH (7.8)
Vector: CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
Links:
Published: Oct. 3, 2025
Modified: March 24, 2026
Modified: March 24, 2026
CVE-2025-11234
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links:
- https://access.redhat.com/errata/RHSA-2025:23228
- https://access.redhat.com/errata/RHSA-2026:0326
- https://access.redhat.com/errata/RHSA-2026:0332
- https://access.redhat.com/errata/RHSA-2026:0702
- https://access.redhat.com/errata/RHSA-2026:1831
- https://access.redhat.com/errata/RHSA-2026:3077
- https://access.redhat.com/errata/RHSA-2026:3165
- https://access.redhat.com/errata/RHSA-2026:5578
- https://access.redhat.com/security/cve/CVE-2025-11234
- https://bugzilla.redhat.com/show_bug.cgi?id=2401209
Published: Feb. 18, 2026
Modified: Feb. 19, 2026
Modified: Feb. 19, 2026
CVE-2025-14876
A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.
Severity: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Links:
Published: Feb. 18, 2026
Modified: Feb. 19, 2026
Modified: Feb. 19, 2026
CVE-2026-0665
An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.
Severity: MEDIUM (6.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Links: