** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a
low-privileged process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/
S:C/C:H/I:H/A:H). Reported via ZDI (ZDI-26-332); fixed upstream in
March 2026 and shipped in QEMU 11.0.
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the
pre-fix implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
The fixed version widens all arithmetic to uint64_t and adds an
explicit size > UINT32_MAX rejection, returning bool with hostmem
as an out-parameter
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
[Current status]
pro fix CVE-2026-3886 reports: "Ubuntu security engineers are
investigating this issue. 1 package is still affected: qemu"
[Upstream status — verified by inspecting tagged source on
https://github.com/qemu/qemu]
v10.2.1 vulnerable <- Ubuntu 26.04 ships this
v10.2.2 vulnerable
v10.2.3 FIXED released 2026-05-26
commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
- "virtio-gpu: fix overflow check when allocating 2d image"
- cherry-picked from c035d5e; committed to stable 2026-04-01
- by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
- Fixes: CVE-2026-3886, ZDI-CAN-27578
- Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d
- resources/images")
+ "virtio-gpu: fix overflow check when allocating 2d image"
+ cherry-picked from c035d5e; committed to stable 2026-04-01
+ by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
+ Fixes: CVE-2026-3886, ZDI-CAN-27578
+ Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d
+ resources/images")
Present in upstream v10.2.3 (released 2026-05-26)
[Status elsewhere]
Debian security tracker
(https://security-tracker.debian.org/tracker/CVE-2026-3886):
bullseye not affected
bookworm not affected
trixie fixed in 1:10.0.10+ds-0+deb13u1
unstable fixed in 1:11.0.0+ds-1
[Notes]
- Public technical analysis of this bug class has been available since
- late April 2026. Requesting triage and an SRU for 26.04.
+ Requesting triage and an SRU for 26.04.
** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a
low-privileged process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/
- S:C/C:H/I:H/A:H). Reported via ZDI (ZDI-26-332); fixed upstream in
- March 2026 and shipped in QEMU 11.0.
+ S:C/C:H/I:H/A:H). Reported via ZDI (ZDI-26-332), CVSS from the ZDI advisory;
Fixed upstream 2026-04-01 (stable branch) and released in QEMU v10.2.3
+ on 2026-05-26
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the
pre-fix implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
The fixed version widens all arithmetic to uint64_t and adds an
explicit size > UINT32_MAX rejection, returning bool with hostmem
as an out-parameter
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
[Current status]
pro fix CVE-2026-3886 reports: "Ubuntu security engineers are
investigating this issue. 1 package is still affected: qemu"
[Upstream status — verified by inspecting tagged source on
https://github.com/qemu/qemu]
v10.2.1 vulnerable <- Ubuntu 26.04 ships this
v10.2.2 vulnerable
v10.2.3 FIXED released 2026-05-26
commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
"virtio-gpu: fix overflow check when allocating 2d image"
cherry-picked from c035d5e; committed to stable 2026-04-01
by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
Fixes: CVE-2026-3886, ZDI-CAN-27578
Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d
resources/images")
Present in upstream v10.2.3 (released 2026-05-26)
[Status elsewhere]
Debian security tracker
(https://security-tracker.debian.org/tracker/CVE-2026-3886):
bullseye not affected
bookworm not affected
trixie fixed in 1:10.0.10+ds-0+deb13u1
unstable fixed in 1:11.0.0+ds-1
- [Notes]
- Requesting triage and an SRU for 26.04.
+ [Request]
+ Requesting triage and an SRU for 26.04.
** Description changed:
[Impact]
- CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
- allocation path, allowing guest-to-host code execution from a
- low-privileged process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/
- S:C/C:H/I:H/A:H). Reported via ZDI (ZDI-26-332), CVSS from the ZDI advisory;
Fixed upstream 2026-04-01 (stable branch) and released in QEMU v10.2.3
- on 2026-05-26
+ CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a low-privileged
process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Reported via ZDI (ZDI-26-332), CVSS from the ZDI advisory; Fixed upstream
2026-04-01 (stable branch) and released in QEMU v10.2.3 on 2026-05-26
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the
pre-fix implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
The fixed version widens all arithmetic to uint64_t and adds an
explicit size > UINT32_MAX rejection, returning bool with hostmem
as an out-parameter
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
[Current status]
pro fix CVE-2026-3886 reports: "Ubuntu security engineers are
investigating this issue. 1 package is still affected: qemu"
[Upstream status — verified by inspecting tagged source on
https://github.com/qemu/qemu]
v10.2.1 vulnerable <- Ubuntu 26.04 ships this
v10.2.2 vulnerable
v10.2.3 FIXED released 2026-05-26
commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
"virtio-gpu: fix overflow check when allocating 2d image"
cherry-picked from c035d5e; committed to stable 2026-04-01
by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
Fixes: CVE-2026-3886, ZDI-CAN-27578
Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d
resources/images")
Present in upstream v10.2.3 (released 2026-05-26)
[Status elsewhere]
Debian security tracker
(https://security-tracker.debian.org/tracker/CVE-2026-3886):
bullseye not affected
bookworm not affected
trixie fixed in 1:10.0.10+ds-0+deb13u1
unstable fixed in 1:11.0.0+ds-1
[Request]
Requesting triage and an SRU for 26.04.
** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a low-privileged
process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Reported via ZDI (ZDI-26-332), CVSS from the ZDI advisory; Fixed upstream
2026-04-01 (stable branch) and released in QEMU v10.2.3 on 2026-05-26
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
- hw/display/virtio-gpu.c in the shipped source still contains the
- pre-fix implementation:
+ hw/display/virtio-gpu.c in the shipped source still contains the pre-fix
implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
- The fixed version widens all arithmetic to uint64_t and adds an
- explicit size > UINT32_MAX rejection, returning bool with hostmem
- as an out-parameter
+ The fixed version widens all arithmetic to uint64_t and adds an explicit
+ size > UINT32_MAX rejection, returning bool with hostmem as an out-
+ parameter
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
[Current status]
- pro fix CVE-2026-3886 reports: "Ubuntu security engineers are
- investigating this issue. 1 package is still affected: qemu"
+ pro fix CVE-2026-3886 reports: "Ubuntu security engineers are investigating
this issue. 1 package is still affected: qemu"
- [Upstream status — verified by inspecting tagged source on
- https://github.com/qemu/qemu]
+ [Upstream status — verified by inspecting tagged source on
https://github.com/qemu/qemu]
v10.2.1 vulnerable <- Ubuntu 26.04 ships this
v10.2.2 vulnerable
v10.2.3 FIXED released 2026-05-26
commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
"virtio-gpu: fix overflow check when allocating 2d image"
cherry-picked from c035d5e; committed to stable 2026-04-01
by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
Fixes: CVE-2026-3886, ZDI-CAN-27578
Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d
resources/images")
Present in upstream v10.2.3 (released 2026-05-26)
[Status elsewhere]
Debian security tracker
(https://security-tracker.debian.org/tracker/CVE-2026-3886):
bullseye not affected
bookworm not affected
trixie fixed in 1:10.0.10+ds-0+deb13u1
unstable fixed in 1:11.0.0+ds-1
[Request]
Requesting triage and an SRU for 26.04.
** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a low-privileged
process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Reported via ZDI (ZDI-26-332), CVSS from the ZDI advisory; Fixed upstream
2026-04-01 (stable branch) and released in QEMU v10.2.3 on 2026-05-26
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the pre-fix
implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
The fixed version widens all arithmetic to uint64_t and adds an explicit
size > UINT32_MAX rejection, returning bool with hostmem as an out-
parameter
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
[Current status]
pro fix CVE-2026-3886 reports: "Ubuntu security engineers are investigating
this issue. 1 package is still affected: qemu"
[Upstream status — verified by inspecting tagged source on
https://github.com/qemu/qemu]
v10.2.1 vulnerable <- Ubuntu 26.04 ships this
v10.2.2 vulnerable
v10.2.3 FIXED released 2026-05-26
- commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
- "virtio-gpu: fix overflow check when allocating 2d image"
+ commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
+ "virtio-gpu: fix overflow check when allocating 2d image"
cherry-picked from c035d5e; committed to stable 2026-04-01
by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
Fixes: CVE-2026-3886, ZDI-CAN-27578
- Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d
- resources/images")
+ Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d resources/images")
Present in upstream v10.2.3 (released 2026-05-26)
[Status elsewhere]
Debian security tracker
(https://security-tracker.debian.org/tracker/CVE-2026-3886):
bullseye not affected
bookworm not affected
trixie fixed in 1:10.0.10+ds-0+deb13u1
unstable fixed in 1:11.0.0+ds-1
[Request]
Requesting triage and an SRU for 26.04.
** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a low-privileged
process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Reported via ZDI (ZDI-26-332), CVSS from the ZDI advisory; Fixed upstream
2026-04-01 (stable branch) and released in QEMU v10.2.3 on 2026-05-26
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the pre-fix
implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
The fixed version widens all arithmetic to uint64_t and adds an explicit
size > UINT32_MAX rejection, returning bool with hostmem as an out-
parameter
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
[Current status]
pro fix CVE-2026-3886 reports: "Ubuntu security engineers are investigating
this issue. 1 package is still affected: qemu"
[Upstream status — verified by inspecting tagged source on
https://github.com/qemu/qemu]
v10.2.1 vulnerable <- Ubuntu 26.04 ships this
v10.2.2 vulnerable
v10.2.3 FIXED released 2026-05-26
- commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
+ commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
"virtio-gpu: fix overflow check when allocating 2d image"
cherry-picked from c035d5e; committed to stable 2026-04-01
by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
Fixes: CVE-2026-3886, ZDI-CAN-27578
- Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d resources/images")
+ Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d resources/images")
Present in upstream v10.2.3 (released 2026-05-26)
[Status elsewhere]
Debian security tracker
(https://security-tracker.debian.org/tracker/CVE-2026-3886):
bullseye not affected
bookworm not affected
trixie fixed in 1:10.0.10+ds-0+deb13u1
unstable fixed in 1:11.0.0+ds-1
[Request]
- Requesting triage and an SRU for 26.04.
+ SRU qemu to 10.2.3, or cherry-pick 2a28de12 into 10.2.1
** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a low-privileged
process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Reported via ZDI (ZDI-26-332), CVSS from the ZDI advisory; Fixed upstream
2026-04-01 (stable branch) and released in QEMU v10.2.3 on 2026-05-26
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the pre-fix
implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
The fixed version widens all arithmetic to uint64_t and adds an explicit
size > UINT32_MAX rejection, returning bool with hostmem as an out-
parameter
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
[Current status]
pro fix CVE-2026-3886 reports: "Ubuntu security engineers are investigating
this issue. 1 package is still affected: qemu"
[Upstream status — verified by inspecting tagged source on
https://github.com/qemu/qemu]
v10.2.1 vulnerable <- Ubuntu 26.04 ships this
v10.2.2 vulnerable
v10.2.3 FIXED released 2026-05-26
commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
"virtio-gpu: fix overflow check when allocating 2d image"
cherry-picked from c035d5e; committed to stable 2026-04-01
by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
Fixes: CVE-2026-3886, ZDI-CAN-27578
Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d resources/images")
+ Present in upstream v10.2.3 (released 2026-05-26)
- Present in upstream v10.2.3 (released 2026-05-26)
+ Note: the fix changes calc_image_hostmem()'s signature to return bool
+ with hostmem as an out-parameter, so a cherry-pick must include the
+ updated call sites
[Status elsewhere]
Debian security tracker
(https://security-tracker.debian.org/tracker/CVE-2026-3886):
bullseye not affected
bookworm not affected
trixie fixed in 1:10.0.10+ds-0+deb13u1
unstable fixed in 1:11.0.0+ds-1
[Request]
SRU qemu to 10.2.3, or cherry-pick 2a28de12 into 10.2.1
** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a low-privileged
process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Reported via ZDI (ZDI-26-332), CVSS from the ZDI advisory; Fixed upstream
2026-04-01 (stable branch) and released in QEMU v10.2.3 on 2026-05-26
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the pre-fix
implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
The fixed version widens all arithmetic to uint64_t and adds an explicit
size > UINT32_MAX rejection, returning bool with hostmem as an out-
parameter
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
[Current status]
pro fix CVE-2026-3886 reports: "Ubuntu security engineers are investigating
this issue. 1 package is still affected: qemu"
[Upstream status — verified by inspecting tagged source on
https://github.com/qemu/qemu]
v10.2.1 vulnerable <- Ubuntu 26.04 ships this
v10.2.2 vulnerable
v10.2.3 FIXED released 2026-05-26
commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
"virtio-gpu: fix overflow check when allocating 2d image"
cherry-picked from c035d5e; committed to stable 2026-04-01
by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
Fixes: CVE-2026-3886, ZDI-CAN-27578
Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d resources/images")
Present in upstream v10.2.3 (released 2026-05-26)
Note: the fix changes calc_image_hostmem()'s signature to return bool
with hostmem as an out-parameter, so a cherry-pick must include the
updated call sites
[Status elsewhere]
Debian security tracker
(https://security-tracker.debian.org/tracker/CVE-2026-3886):
bullseye not affected
bookworm not affected
trixie fixed in 1:10.0.10+ds-0+deb13u1
unstable fixed in 1:11.0.0+ds-1
[Request]
- SRU qemu to 10.2.3, or cherry-pick 2a28de12 into 10.2.1
+ Requesting a security update for qemu in Ubuntu 26.04
** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a low-privileged
process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Reported via ZDI (ZDI-26-332), CVSS from the ZDI advisory; Fixed upstream
2026-04-01 (stable branch) and released in QEMU v10.2.3 on 2026-05-26
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the pre-fix
implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
The fixed version widens all arithmetic to uint64_t and adds an explicit
size > UINT32_MAX rejection, returning bool with hostmem as an out-
parameter
- No CVE-named patch is present in debian/patches/; the series file
- contains no security patches.
+ No CVE-named patch is present in debian/patches/
[Current status]
pro fix CVE-2026-3886 reports: "Ubuntu security engineers are investigating
this issue. 1 package is still affected: qemu"
[Upstream status — verified by inspecting tagged source on
https://github.com/qemu/qemu]
v10.2.1 vulnerable <- Ubuntu 26.04 ships this
v10.2.2 vulnerable
v10.2.3 FIXED released 2026-05-26
commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
"virtio-gpu: fix overflow check when allocating 2d image"
cherry-picked from c035d5e; committed to stable 2026-04-01
by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
Fixes: CVE-2026-3886, ZDI-CAN-27578
Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d resources/images")
Present in upstream v10.2.3 (released 2026-05-26)
Note: the fix changes calc_image_hostmem()'s signature to return bool
with hostmem as an out-parameter, so a cherry-pick must include the
updated call sites
[Status elsewhere]
Debian security tracker
(https://security-tracker.debian.org/tracker/CVE-2026-3886):
bullseye not affected
bookworm not affected
trixie fixed in 1:10.0.10+ds-0+deb13u1
unstable fixed in 1:11.0.0+ds-1
[Request]
Requesting a security update for qemu in Ubuntu 26.04
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162697
Title:
CVE-2026-3886: virtio-gpu integer overflow (calc_image_hostmem)
unfixed in qemu 1:10.2.1+ds-1ubuntu3.1
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2162697/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
