qemu-kvm vulnerabilities
CVEs whose affected-version data names the qemu-kvm package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-93834High· 8.8PoCA use-after-free vulnerability was found in QEMU's 9pfs subsystem
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path cont…
CVE-2026-81627High· 8.2PoCA flaw was found in QEMU
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked S…
CVE-2026-6426Medium· 4.4A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling
A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted…
CVE-2026-12080High· 7.3PoCA flaw was found in the QEMU Guest Agent (qga)
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic dire…
CVE-2025-11234High· 7.5A flaw was found in QEMU
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel.…
CVE-2024-7409High· 7.5A flaw was found in the QEMU NBD Server
A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.