Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CVE-2026-61476: QEMU on Debian may lose memory with bad SCSI request
CVE-2026-61476 · published 2 months ago
Summary
The QEMU virtualization program used in Debian can leak memory when it receives a malformed SCSI command. Over time this can reduce system performance or cause a crash. Install the latest QEMU updates from your Debian package source to apply the fix.
What to do
- Update bellsoft qemu to version 9.0.4-r3.
- Update bellsoft qemu to version 10.0.13-r0.
- Update bellsoft qemu to version 11.1.1-r0.
- Update debian qemu to version 1:11.1.0+ds-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Alpaquita:23 | bellsoft | qemu |
>= 7.1.0-r4, < 9.0.4-r3 Fix: upgrade to 9.0.4-r3
|
| Alpaquita:25 | bellsoft | qemu |
>= 10.0.0-r1, < 10.0.13-r0 Fix: upgrade to 10.0.13-r0
|
| Alpaquita:stream | bellsoft | qemu |
>= 8.0.2-r0, < 11.1.1-r0 Fix: upgrade to 11.1.1-r0
|
| Debian:11 | debian | qemu | All versions |
| Debian:12 | debian | qemu | All versions |
| Debian:13 | debian | qemu | All versions |
| Debian:14 | debian | qemu |
< 1:11.1.0+ds-1 Fix: upgrade to 1:11.1.0+ds-1
|
| Ubuntu:Pro:14.04:LTS | canonical | qemu | All versions |
| Ubuntu:26.10 | canonical | qemu-hwe | All versions |
Original advisory text
DEBIAN-CVE-2026-61476
virtio-scsi: fix SCSIRequest leak on a bad request
References
- https://security-tracker.debian.org/tracker/CVE-2026-61476 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-61476 Vendor Advisory
- https://gitlab.com/qemu-project/qemu/-/work_items/3875 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-61476 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-61476 Third Party Advisory
Timeline
Published31 Aug 2026
Updated22 Oct 2026
First seen30 Aug 2026
Track software like this
Free during beta