Back Linuxsecurity

Ubuntu 25.10 QEMU Critical Denial of Service Exec USN-8161

Linuxsecurity •LinuxSecurity Advisories • April 10, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in QEMU. Software Description: - qemu: Machine emulator and virtualizer Details: It was discovered that the LSI53C895A SCSI Host Bus Adapter implementation of QEMU incorrectly handled memory. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-6519) It was discovered that QEMU could be made to read out of bounds when reading VMDK images. If a user or an automated system were tricked into opening a specially crafted VMDK image, an attacker could possibly use this issue to leak sensitive informaton or cause QEMU to crash, resulting in a denial of service. (CVE-2026-2243) It was discovered that the virtio-snd device implementation of QEMU could

The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 qemu-system 1:10.1.0+ds-5ubuntu2.6 qemu-system-arm 1:10.1.0+ds-5ubuntu2.6 qemu-system-common 1:10.1.0+ds-5ubuntu2.6 qemu-system-data 1:10.1.0+ds-5ubuntu2.6 qemu-system-gui 1:10.1.0+ds-5ubuntu2.6 qemu-system-mips 1:10.1.0+ds-5ubuntu2.6 qemu-system-misc 1:10.1.0+ds-5ubuntu2.6 qemu-system-modules-opengl 1:10.1.0+ds-5ubuntu2.6 qemu-system-modules-spice 1:10.1.0+ds-5ubuntu2.6 qemu-system-ppc 1:10.1.0+ds-5ubuntu2.6 qemu-system-riscv 1:10.1.0+ds-5ubuntu2.6 qemu-system-s390x 1:10.1.0+ds-5ubuntu2.6 qemu-system-sparc 1:10.1.0+ds-5ubuntu2.6 qemu-system-x86 1:10.1.0+ds-5ubuntu2.6 qemu-system-x86-xen 1:10.1.0+ds-5ubuntu2.6 qemu-system-xen 1:10.1.0+ds-5ubuntu2.6 Ubuntu 24.04 LTS qemu-system 1:8.2.2+ds-0ubuntu1.16 qemu-system-arm 1:8.2.2+ds-0ubuntu1.16 qemu-system-common 1:8.2.2+ds-0ubuntu1.16 qemu-system-data 1:8.2.2+ds-0ubuntu1.16 qemu-system-gui 1:8.2.2+ds-0ubuntu1.16 qemu-system-mips 1:8.2.2+ds-0ubuntu1.16 qemu-system-misc 1:8.2.2+ds-0ubuntu1.16 qemu-system-modules-opengl 1:8.2.2+ds-0ubuntu1.16 qemu-system-modules-spice 1:8.2.2+ds-0ubuntu1.16 qemu-system-ppc 1:8.2.2+ds-0ubuntu1.16 qemu-system-s390x 1:8.2.2+ds-0ubuntu1.16 qemu-system-sparc 1:8.2.2+ds-0ubuntu1.16 qemu-system-x86 1:8.2.2+ds-0ubuntu1.16 qemu-system-x86-xen 1:8.2.2+ds-0ubuntu1.16 qemu-system-xen 1:8.2.2+ds-0ubuntu1.16 Ubuntu 22.04 LTS qemu 1:6.2+dfsg-2ubuntu6.30 qemu-system 1:6.2+dfsg-2ubuntu6.30 qemu-system-arm 1:6.2+dfsg-2ubuntu6.30 qemu-system-common 1:6.2+dfsg-2ubuntu6.30 qemu-system-data 1:6.2+dfsg-2ubuntu6.30 qemu-system-gui 1:6.2+dfsg-2ubuntu6.30 qemu-system-mips 1:6.2+dfsg-2ubuntu6.30 qemu-system-misc 1:6.2+dfsg-2ubuntu6.30 qemu-system-ppc 1:6.2+dfsg-2ubuntu6.30 qemu-system-s390x 1:6.2+dfsg-2ubuntu6.30 qemu-system-sparc 1:6.2+dfsg-2ubuntu6.30 qemu-system-x86 1:6.2+dfsg-2ubuntu6.30 qemu-system-x86-microvm 1:6.2+dfsg-2ubuntu6.30 qemu-system-x86-xen 1:6.2+dfsg-2ubuntu6.30 After a standard system update you need to restart all QEMU virtual machines to make all the necessary changes.

CVE-2024-6519, CVE-2026-2243, CVE-2026-3195, CVE-2026-3196, CVE-2026-3842

CVE-2024-6519, CVE-2026-2243, CVE-2026-3195, CVE-2026-3196,

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical QEMU Vulnerabilities Affect Ubuntu Systems Multiple vulnerabilities in QEMU have been identified, impacting Ubuntu 25.10, 24.04 LTS, and 22.04 LTS. The issues include improper memory handling in the LSI53C895A SCSI Host Bus Adapter (CVE-2024-6519) and out-of-bounds reads when processing VMDK images (CVE-2026-2243). An attacker inside a guest system could exploit these vulnerabilities to crash QEMU, leading to denial of service or potentially executing arbitrary code. Additionally, the virtio-snd device implementation has vulnerabilities that could allow out-of-bounds writes and arithmetic overflows, affecting Ubuntu 25.10 and 24.04 LTS (CVE-2026-3195). Users are advised to update their systems to the latest package versions to mitigate these risks. The vulnerabilities were disclosed on April 9 and 10, 2026, with patches available for affected systems. 2 sources 74

Extracted Entities

Ubuntu 25.10 QEMU Critical Denial of Service Exec USN-8161

The full story

Extracted Entities

Attack Types (1)

CVEs (5)

Platforms (1)