Alerts This Week
Warning Icon 1 1,149
Alerts This Week
Warning Icon 1 1,149

openSUSE Leap 16.0 Essential Security Patch for qemu DoS 2026-20567-1

opensuse
Calendar Grey April 21, 2026
Dist Opensuse Esm H88
Important security updates for openSUSE qemu address critical issues and enhance overall system security efficiency.
An update that solves 3 vulnerabilities and has 3 bug fixes can now be installed.

Description

This update for qemu fixes the following issues:

Update to version 10.0.9.

Security issues fixed:

- CVE-2026-3196: unbounded memory allocation and host denial-of-service via PCM_INFO requests sent from the guest

(bsc#1259079).

- CVE-2026-3195: heap out-of-bounds write when reading input audio in the virtio-snd device input callback

(bsc#1259080).

- CVE-2026-2243: heap out-of-bounds read and 12-byte information leak when processing specially crafted VMDK files

with qemu-img (bsc#1258509).

Other updates and bugfixes:

- Version 10.0.9:

* Full backport list: https://lore.kernel.org/qemu-devel/20260318045608.7E1B513DFF6@think4mjt.localdomain/

* hyperv/syndbg: check length returned by cpu_physical_memory_map()

* fuse: Copy write buffer content before polling

* target/loongarch: Avoid recursive PNX exception on CSR_BADI fetch

* target/loongarch: Preserve PTE permission bits in LDPTE

* hw/net/npcm_gmac: Catch accesses off the end of the register array

*...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service important QEMU OpenSUSE heap issue

Patch

Package List

- openSUSE Leap 16.0:

qemu-10.0.9-160000.1.1

qemu-SLOF-10.0.9-160000.1.1

qemu-accel-qtest-10.0.9-160000.1.1

qemu-arm-10.0.9-160000.1.1

qemu-audio-alsa-10.0.9-160000.1.1

qemu-audio-dbus-10.0.9-160000.1.1

qemu-audio-jack-10.0.9-160000.1.1

qemu-audio-oss-10.0.9-160000.1.1

qemu-audio-pa-10.0.9-160000.1.1

qemu-audio-pipewire-10.0.9-160000.1.1

qemu-audio-spice-10.0.9-160000.1.1

qemu-block-curl-10.0.9-160000.1.1

qemu-block-dmg-10.0.9-160000.1.1

qemu-block-iscsi-10.0.9-160000.1.1

qemu-block-nfs-10.0.9-160000.1.1

qemu-block-rbd-10.0.9-160000.1.1

qemu-block-ssh-10.0.9-160000.1.1

qemu-chardev-baum-10.0.9-160000.1.1

qemu-chardev-spice-10.0.9-160000.1.1

qemu-doc-10.0.9-160000.1.1

qemu-extra-10.0.9-160000.1.1

qemu-guest-agent-10.0.9-160000.1.1

qemu-headless-10.0.9-160000.1.1

qemu-hw-display-qxl-10.0.9-160000.1.1

qemu-hw-display-virtio-gpu-10.0.9-160000.1.1

qemu-hw-display-virtio-gpu-pci-10.0.9-160000.1.1

qemu-hw-display-virtio-vga-10.0.9-160000.1.1

qemu-hw-s390x-virtio-gpu-ccw-10.0.9-160000.1.1

qemu-hw-usb-host-10.0.9-160000.1....

Read the Full Advisory

References

* bsc#1258509

* bsc#1259079

* bsc#1259080

References:

* https://www.suse.com/security/cve/CVE-2026-2243.html

* https://www.suse.com/security/cve/CVE-2026-3195.html

* https://www.suse.com/security/cve/CVE-2026-3196.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2026:20567-1
Rating: important
Affected Products: openSUSE Leap 16.0 -------------------------------------------------------------

Topics%20covered

Topics Covered

security advisory denial of service important QEMU OpenSUSE heap issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here