Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
qemu can let privileged guest bypass protection
published 28 days ago
Summary
The qemu virtualization software had a flaw that allowed a user inside a virtual machine with high privileges to break the chip’s lock and inject code into a special low-level memory area. This could let an attacker gain deeper control of the host system. Update qemu to the latest version as soon as possible to close the gap.
What to do
- Update suse qemu to version 10.0.13-160000.2.1.
- Update suse qemu-linux-user to version 10.0.13-160000.2.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Server 16.0 | suse | qemu |
< 10.0.13-160000.2.1 Fix: upgrade to 10.0.13-160000.2.1
|
| SUSE:Linux Enterprise Server 16.0 | suse | qemu-linux-user |
< 10.0.13-160000.2.1 Fix: upgrade to 10.0.13-160000.2.1
|
| SUSE:Linux Enterprise Server for SAP applications 16.0 | suse | qemu |
< 10.0.13-160000.2.1 Fix: upgrade to 10.0.13-160000.2.1
|
| SUSE:Linux Enterprise Server for SAP applications 16.0 | suse | qemu-linux-user |
< 10.0.13-160000.2.1 Fix: upgrade to 10.0.13-160000.2.1
|
Original advisory text
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to
bypass chipset `D_LCK` protection and injecting code into System Management Mode memory (bsc#1282077).
- CVE-2026-93834: hw/9pfs: mutate FID path from main thread only (bsc#1282578).
Changes for qemu:
- Bugfixes:
* [openSUSE][RPM] spec: drop qemu-ipxe Requires for ppc (bsc#1282918)
* virtio: fix queue size validation against allocated maximum (bsc#1279962)
* virtio-mmio: fix QUEUE_NUM_MAX (bsc#1279962)
* target/ppc/kvm: Use host compatibility mode for nested guests (bsc#1263864)
* target/ppc/kvm: Add support for querying host compatibility mode (bsc#1263864)
* linux-headers: Update to include KVM_CAP_PPC_COMPAT_CAPS (bsc#1263864)
* linux-headers: Update to Linux v7.2-rc1 with KVM_S390_VM_CPU_FEAT_ASTFLEIE2 (bsc#1263864)
* linux-headers: Update to Linux v7.1-rc4 (bsc#1263864)
* scripts/update-linux-headers: Add typelimits.h (bsc#1263864)
* update-linux-headers: Inject VIRTIO_RING_NO_LEGACY in virtio_ring.h (bsc#1263864)
* linux-headers: Add nitro_enclaves.h (bsc#1263864)
* scripts/update-linux-headers: Add Nitro Enclaves header (bsc#1263864)
* standard-headers: Update virtio_spi.h from Linux v6.18-rc3 (bsc#1263864)
* linux-headers: Update to Linux v6.19-rc1 (bsc#1263864)
* update-linux-headers: Remove "asm-s390/unistd_32.h" (bsc#1263864)
* linux-headers: Update to Linux v6.18-rc3 (bsc#1263864)
* linux-headers/linux: Add mshv.h headers (bsc#1263864)
* include/hw/hyperv: Add MSHV ABI header definitions (bsc#1263864)
* linux-headers: Update to Linux v6.17-rc1 (bsc#1263864)
* linux-headers: deal with counted_by annotation (bsc#1263864)
* linux-headers: Remove the 32-bit arm headers (bsc#1263864)
* update Linux headers to KVM tree master (bsc#1263864)
Security issues fixed:
- CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to
bypass chipset `D_LCK` protection and injecting code into System Management Mode memory (bsc#1282077).
- CVE-2026-93834: hw/9pfs: mutate FID path from main thread only (bsc#1282578).
Changes for qemu:
- Bugfixes:
* [openSUSE][RPM] spec: drop qemu-ipxe Requires for ppc (bsc#1282918)
* virtio: fix queue size validation against allocated maximum (bsc#1279962)
* virtio-mmio: fix QUEUE_NUM_MAX (bsc#1279962)
* target/ppc/kvm: Use host compatibility mode for nested guests (bsc#1263864)
* target/ppc/kvm: Add support for querying host compatibility mode (bsc#1263864)
* linux-headers: Update to include KVM_CAP_PPC_COMPAT_CAPS (bsc#1263864)
* linux-headers: Update to Linux v7.2-rc1 with KVM_S390_VM_CPU_FEAT_ASTFLEIE2 (bsc#1263864)
* linux-headers: Update to Linux v7.1-rc4 (bsc#1263864)
* scripts/update-linux-headers: Add typelimits.h (bsc#1263864)
* update-linux-headers: Inject VIRTIO_RING_NO_LEGACY in virtio_ring.h (bsc#1263864)
* linux-headers: Add nitro_enclaves.h (bsc#1263864)
* scripts/update-linux-headers: Add Nitro Enclaves header (bsc#1263864)
* standard-headers: Update virtio_spi.h from Linux v6.18-rc3 (bsc#1263864)
* linux-headers: Update to Linux v6.19-rc1 (bsc#1263864)
* update-linux-headers: Remove "asm-s390/unistd_32.h" (bsc#1263864)
* linux-headers: Update to Linux v6.18-rc3 (bsc#1263864)
* linux-headers/linux: Add mshv.h headers (bsc#1263864)
* include/hw/hyperv: Add MSHV ABI header definitions (bsc#1263864)
* linux-headers: Update to Linux v6.17-rc1 (bsc#1263864)
* linux-headers: deal with counted_by annotation (bsc#1263864)
* linux-headers: Remove the 32-bit arm headers (bsc#1263864)
* update Linux headers to KVM tree master (bsc#1263864)
References
- https://www.suse.com/support/update/announcement/2026/suse-su-202624159-1/ Vendor Advisory
- https://bugzilla.suse.com/1263864 Third Party Advisory
- https://bugzilla.suse.com/1279962 Third Party Advisory
- https://bugzilla.suse.com/1282077 Third Party Advisory
- https://bugzilla.suse.com/1282578 Third Party Advisory
- https://bugzilla.suse.com/1282918 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-81627 URL
- https://www.suse.com/security/cve/CVE-2026-93834 URL
Timeline
Published7 Oct 2026
Updated16 Oct 2026
First seen16 Oct 2026
Sources
SUSE-SU-2026:24159-1 · OSV
Track software like this
Free during beta