Vulnerability · Published Jun 12, 2026 · Assigned by redhat
CVE-2026-48914Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling
Medium 6.7
In plain English
A medium-severity heap buffer overflow in qemu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.7Medium
Exploit odds (30 days)0.2%top 95.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | qemu-guest-agent | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-guest-agent | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-img | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-img | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-audio-pa | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-audio-pa | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-block-blkio | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-block-blkio | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-block-curl | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-block-curl | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-block-rbd | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-block-rbd | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-common | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-common | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-core | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-core | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-device-display-virtio-gpu | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-device-display-virtio-gpu | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-device-display-virtio-gpu-ccw | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-device-display-virtio-gpu-ccw | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-device-display-virtio-gpu-pci | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-device-display-virtio-gpu-pci | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-device-display-virtio-vga | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-device-display-virtio-vga | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-device-usb-host | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-device-usb-host | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-device-usb-redirect | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-device-usb-redirect | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-docs | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-docs | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-tools | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-tools | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-ui-egl-headless | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-ui-egl-headless | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-kvm-ui-opengl | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-kvm-ui-opengl | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| AlmaLinux:10 | qemu-pr-helper | 18:10.1.0-16.el10_2.5.alma.1 | ALSA-2026:58571 |
| AlmaLinux:9 | qemu-pr-helper | 17:10.1.0-17.el9_8.4.alma.1 | ALSA-2026:39311 |
| Debian:12 | qemu | no fix listed | DEBIAN-CVE-2026-48914 |
| Debian:13 | qemu | 1:10.0.11+ds-0+deb13u1 | DEBIAN-CVE-2026-48914 |
| Debian:14 | qemu | 1:11.0.2+ds-1 | DEBIAN-CVE-2026-48914 |
| Rocky Linux:10 | qemu-kvm | 8:10.1.0-16.el10_2.5 | RLSA-2026:58571 |
| Rocky Linux:9 | qemu-kvm | 7:10.1.0-17.el9_8.4 | RLSA-2026:39311 |
| Ubuntu:22.04:LTS | qemu | no fix listed | UBUNTU-CVE-2026-48914 |
| Ubuntu:24.04:LTS | qemu | no fix listed | UBUNTU-CVE-2026-48914 |
| Ubuntu:25.10 | qemu | no fix listed | UBUNTU-CVE-2026-48914 |
| Ubuntu:26.04:LTS | qemu | no fix listed | UBUNTU-CVE-2026-48914 |
| Ubuntu:26.10 | qemu | no fix listed | UBUNTU-CVE-2026-48914 |
| Ubuntu:26.04:LTS | qemu-hwe | no fix listed | UBUNTU-CVE-2026-48914 |
| Ubuntu:26.10 | qemu-hwe | no fix listed | UBUNTU-CVE-2026-48914 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| qemu | 1.1.0 – through 11.0.1 | |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux for NVIDIA 26 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
| Red Hat | Red Hat OpenShift Container Platform 5 | see references |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
References
- RHSA-2026:39311 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:58571 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-48914 vdb-entry, x_refsource_REDHAT
- RHBZ#2488283 issue-tracking, x_refsource_REDHAT
- https://lore.kernel.org/qemu-devel/20260526154957.1741622-1-stefanha@redhat.com/