Critical QEMU Vulnerabilities Affect Ubuntu Systems

Severity: High (Score: 74.0)

Sources: Ubuntu, Linuxsecurity

Summary

Multiple vulnerabilities in QEMU have been identified, impacting Ubuntu 25.10, 24.04 LTS, and 22.04 LTS. The issues include improper memory handling in the LSI53C895A SCSI Host Bus Adapter (CVE-2024-6519) and out-of-bounds reads when processing VMDK images (CVE-2026-2243). An attacker inside a guest system could exploit these vulnerabilities to crash QEMU, leading to denial of service or potentially executing arbitrary code. Additionally, the virtio-snd device implementation has vulnerabilities that could allow out-of-bounds writes and arithmetic overflows, affecting Ubuntu 25.10 and 24.04 LTS (CVE-2026-3195). Users are advised to update their systems to the latest package versions to mitigate these risks. The vulnerabilities were disclosed on April 9 and 10, 2026, with patches available for affected systems. Key Points: • Multiple critical vulnerabilities in QEMU affect Ubuntu 25.10 and 24.04 LTS. • Exploits could lead to denial of service or arbitrary code execution. • Immediate system updates are recommended to mitigate the risks.

Key Entities

• Data Breach (attack_type)
• DDoS (attack_type)
• CVE-2024-6519 (cve)
• CVE-2026-2243 (cve)
• CVE-2026-3195 (cve)
• CVE-2026-3196 (cve)
• CVE-2026-3842 (cve)
• Hyper-V (platform)
• QEMU (platform)
• Ubuntu (company)