Back Linuxsecurity

SUSE 2026-23362-1 QEMU Important Local Escalation Fix CVE-2026

Linuxsecurity •LinuxSecurity Advisories • August 31, 2026

Find practical guidance for preventing, investigating, and responding to Linux security problems. Review Linux Privileges ×

## This update for qemu fixes the following issue: * CVE-2026-3886: lack of proper validation of user-supplied data in the `virtio-gpu` driver can lead to local privilege escalation via an integer overflow (bsc#1268061). Other updates and bugfixes: * Service: switch back to `tar_scm`. * Bug fixes: * target/s390x: Make container ids in `SysIB_15x` 1-based (bsc#1275490). * target/s390x: move `@deprecated-props` to `CpuModelExpansionInfo` (bsc#1273447). * target/s390x: filter deprecated properties based on model expansion type (bsc#1273447). * target/s390x: flag `te` and `cte` as deprecated (bsc#1273447). * target/s390x: report `deprecated-props` in `cpu-model-expansion` (bsc#1273447). * qemu-ga: fix service file against no-autostart (bsc#1199023). ## Patch Instructions:

* CVE-2026-3886 ( SUSE ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

* SUSE Linux Micro 6.0

An update that solves one vulnerability and has three fixes can now be

Announcement ID: SUSE-SU-2026:23362-1 Release Date: 2026-08-27T12:46:50Z Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Local Privilege Escalation Vulnerability in QEMU (CVE-2026-3886) An important advisory was issued for SUSE Micro 6.1 regarding a vulnerability in QEMU, specifically CVE-2026-3886. This flaw arises from inadequate validation of user-supplied data in the 'virtio-gpu' driver, potentially allowing local privilege escalation through an integer overflow. The vulnerability affects systems running SUSE Linux Micro 6.1 and earlier versions. The CVSS score for this vulnerability is 8.8, indicating a high severity level. Alongside this critical fix, several other updates and bug fixes were also included in the advisory. The vulnerability was disclosed on August 27, 2026, with patches made available immediately. Administrators are urged to apply the updates promptly to mitigate the risk of exploitation. The advisory highlights the importance of maintaining updated systems to prevent potential local attacks. 2 sources 57

Extracted Entities

SUSE 2026-23362-1 QEMU Important Local Escalation Fix CVE-2026

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)