Stay Secure with the Latest Linux Advisories

security advisorydebiandata destruction

Debian DSA-6145-1 Nova Image Resize Issue CVE-2026-24708

Dan Smith discovered that nova, a cloud computing fabric controller, calls qemu-img without format restrictions for resize, which may result in unsafe image resize operations that could destroy data on the host system. Only compute nodes using the Flat image backend are affected. For the oldstable distribution (bookworm), this problem has been fixed. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6145-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Salvatore Bonaccorso February 19, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : nova CVE ID : CVE-2026-24708 Debian Bug : 1128294 Dan Smith discovered that nova, a cloud computing fabric controller, calls qemu-img without format restrictions for resize, which may result in unsafe image resize operations that could destroy data on the host system. Only compute nodes using the Flat image backend are affected. For the oldstable distribution (bookworm), this problem has been fixed in version 2:26.2.2-1~deb12u4. For the stable distribution (trixie), this problem has been fixed in version 2:31.0.0-6+deb13u2. We recommend that you upgrade your nova packages. For the detailed security status of nova please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/nova Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Unsanctioned image resize in nova could lead to host data destruction. Upgrade recommended for Debian users to improve security.. cloud computing,nova security,debian advisory,data destruction. . Severity: Informational. LinuxSecurity.com Team

Feb 19, 2026 •Informational Debian