openSUSE-SU-2026:22047-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22047-1.json

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22047-1

Upstream

CVE (2)

CVE-2026-81627
CVE-2026-93834

Related

CVE (2)

CVE-2026-81627
CVE-2026-93834

Published

2026-10-07T09:59:52Z

Modified

2026-10-19T17:23:10Z

Summary

Security update for qemu

Details

This update for qemu fixes the following issues:

Security issues fixed:

CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to bypass chipset D_LCK protection and injecting code into System Management Mode memory (bsc#1282077).
CVE-2026-93834: hw/9pfs: mutate FID path from main thread only (bsc#1282578).

Changes for qemu:

Bugfixes:

[openSUSE][RPM] spec: drop qemu-ipxe Requires for ppc (bsc#1282918)
virtio: fix queue size validation against allocated maximum (bsc#1279962)
virtio-mmio: fix QUEUE_NUM_MAX (bsc#1279962)
target/ppc/kvm: Use host compatibility mode for nested guests (bsc#1263864)
target/ppc/kvm: Add support for querying host compatibility mode (bsc#1263864)
linux-headers: Update to include KVM_CAP_PPC_COMPAT_CAPS (bsc#1263864)
linux-headers: Update to Linux v7.2-rc1 with KVM_S390_VM_CPU_FEAT_ASTFLEIE2 (bsc#1263864)
linux-headers: Update to Linux v7.1-rc4 (bsc#1263864)
scripts/update-linux-headers: Add typelimits.h (bsc#1263864)
update-linux-headers: Inject VIRTIO_RING_NO_LEGACY in virtio_ring.h (bsc#1263864)
linux-headers: Add nitro_enclaves.h (bsc#1263864)
scripts/update-linux-headers: Add Nitro Enclaves header (bsc#1263864)
standard-headers: Update virtio_spi.h from Linux v6.18-rc3 (bsc#1263864)
linux-headers: Update to Linux v6.19-rc1 (bsc#1263864)
update-linux-headers: Remove "asm-s390/unistd_32.h" (bsc#1263864)
linux-headers: Update to Linux v6.18-rc3 (bsc#1263864)
linux-headers/linux: Add mshv.h headers (bsc#1263864)
include/hw/hyperv: Add MSHV ABI header definitions (bsc#1263864)
linux-headers: Update to Linux v6.17-rc1 (bsc#1263864)
linux-headers: deal with counted_by annotation (bsc#1263864)
linux-headers: Remove the 32-bit arm headers (bsc#1263864)
update Linux headers to KVM tree master (bsc#1263864)

References

Affected packages

openSUSE:Leap 16.0 / qemu

Package

Name: qemu
Purl: pkg:rpm/opensuse/qemu&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.0.13-160000.2.1

Ecosystem specific

{
    "binaries": [
        {
            "qemu": "10.0.13-160000.2.1",
            "qemu-SLOF": "10.0.13-160000.2.1",
            "qemu-accel-qtest": "10.0.13-160000.2.1",
            "qemu-arm": "10.0.13-160000.2.1",
            "qemu-audio-alsa": "10.0.13-160000.2.1",
            "qemu-audio-dbus": "10.0.13-160000.2.1",
            "qemu-audio-jack": "10.0.13-160000.2.1",
            "qemu-audio-oss": "10.0.13-160000.2.1",
            "qemu-audio-pa": "10.0.13-160000.2.1",
            "qemu-audio-pipewire": "10.0.13-160000.2.1",
            "qemu-audio-spice": "10.0.13-160000.2.1",
            "qemu-block-curl": "10.0.13-160000.2.1",
            "qemu-block-dmg": "10.0.13-160000.2.1",
            "qemu-block-iscsi": "10.0.13-160000.2.1",
            "qemu-block-nfs": "10.0.13-160000.2.1",
            "qemu-block-rbd": "10.0.13-160000.2.1",
            "qemu-block-ssh": "10.0.13-160000.2.1",
            "qemu-chardev-baum": "10.0.13-160000.2.1",
            "qemu-chardev-spice": "10.0.13-160000.2.1",
            "qemu-doc": "10.0.13-160000.2.1",
            "qemu-extra": "10.0.13-160000.2.1",
            "qemu-guest-agent": "10.0.13-160000.2.1",
            "qemu-headless": "10.0.13-160000.2.1",
            "qemu-hw-display-qxl": "10.0.13-160000.2.1",
            "qemu-hw-display-virtio-gpu": "10.0.13-160000.2.1",
            "qemu-hw-display-virtio-gpu-pci": "10.0.13-160000.2.1",
            "qemu-hw-display-virtio-vga": "10.0.13-160000.2.1",
            "qemu-hw-s390x-virtio-gpu-ccw": "10.0.13-160000.2.1",
            "qemu-hw-usb-host": "10.0.13-160000.2.1",
            "qemu-hw-usb-redirect": "10.0.13-160000.2.1",
            "qemu-hw-usb-smartcard": "10.0.13-160000.2.1",
            "qemu-img": "10.0.13-160000.2.1",
            "qemu-ipxe": "10.0.13-160000.2.1",
            "qemu-ivshmem-tools": "10.0.13-160000.2.1",
            "qemu-ksm": "10.0.13-160000.2.1",
            "qemu-lang": "10.0.13-160000.2.1",
            "qemu-linux-user": "10.0.13-160000.2.1",
            "qemu-microvm": "10.0.13-160000.2.1",
            "qemu-ppc": "10.0.13-160000.2.1",
            "qemu-pr-helper": "10.0.13-160000.2.1",
            "qemu-s390x": "10.0.13-160000.2.1",
            "qemu-seabios": "10.0.131.16.3_3_g3d33c746-160000.2.1",
            "qemu-skiboot": "10.0.13-160000.2.1",
            "qemu-spice": "10.0.13-160000.2.1",
            "qemu-tools": "10.0.13-160000.2.1",
            "qemu-ui-curses": "10.0.13-160000.2.1",
            "qemu-ui-dbus": "10.0.13-160000.2.1",
            "qemu-ui-gtk": "10.0.13-160000.2.1",
            "qemu-ui-opengl": "10.0.13-160000.2.1",
            "qemu-ui-spice-app": "10.0.13-160000.2.1",
            "qemu-ui-spice-core": "10.0.13-160000.2.1",
            "qemu-vgabios": "10.0.131.16.3_3_g3d33c746-160000.2.1",
            "qemu-vhost-user-gpu": "10.0.13-160000.2.1",
            "qemu-vmsr-helper": "10.0.13-160000.2.1",
            "qemu-x86": "10.0.13-160000.2.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22047-1.json"

openSUSE:Leap 16.0 / qemu-linux-user

Package

Name: qemu-linux-user
Purl: pkg:rpm/opensuse/qemu-linux-user&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.0.13-160000.2.1

Ecosystem specific

{
    "binaries": [
        {
            "qemu": "10.0.13-160000.2.1",
            "qemu-SLOF": "10.0.13-160000.2.1",
            "qemu-accel-qtest": "10.0.13-160000.2.1",
            "qemu-arm": "10.0.13-160000.2.1",
            "qemu-audio-alsa": "10.0.13-160000.2.1",
            "qemu-audio-dbus": "10.0.13-160000.2.1",
            "qemu-audio-jack": "10.0.13-160000.2.1",
            "qemu-audio-oss": "10.0.13-160000.2.1",
            "qemu-audio-pa": "10.0.13-160000.2.1",
            "qemu-audio-pipewire": "10.0.13-160000.2.1",
            "qemu-audio-spice": "10.0.13-160000.2.1",
            "qemu-block-curl": "10.0.13-160000.2.1",
            "qemu-block-dmg": "10.0.13-160000.2.1",
            "qemu-block-iscsi": "10.0.13-160000.2.1",
            "qemu-block-nfs": "10.0.13-160000.2.1",
            "qemu-block-rbd": "10.0.13-160000.2.1",
            "qemu-block-ssh": "10.0.13-160000.2.1",
            "qemu-chardev-baum": "10.0.13-160000.2.1",
            "qemu-chardev-spice": "10.0.13-160000.2.1",
            "qemu-doc": "10.0.13-160000.2.1",
            "qemu-extra": "10.0.13-160000.2.1",
            "qemu-guest-agent": "10.0.13-160000.2.1",
            "qemu-headless": "10.0.13-160000.2.1",
            "qemu-hw-display-qxl": "10.0.13-160000.2.1",
            "qemu-hw-display-virtio-gpu": "10.0.13-160000.2.1",
            "qemu-hw-display-virtio-gpu-pci": "10.0.13-160000.2.1",
            "qemu-hw-display-virtio-vga": "10.0.13-160000.2.1",
            "qemu-hw-s390x-virtio-gpu-ccw": "10.0.13-160000.2.1",
            "qemu-hw-usb-host": "10.0.13-160000.2.1",
            "qemu-hw-usb-redirect": "10.0.13-160000.2.1",
            "qemu-hw-usb-smartcard": "10.0.13-160000.2.1",
            "qemu-img": "10.0.13-160000.2.1",
            "qemu-ipxe": "10.0.13-160000.2.1",
            "qemu-ivshmem-tools": "10.0.13-160000.2.1",
            "qemu-ksm": "10.0.13-160000.2.1",
            "qemu-lang": "10.0.13-160000.2.1",
            "qemu-linux-user": "10.0.13-160000.2.1",
            "qemu-microvm": "10.0.13-160000.2.1",
            "qemu-ppc": "10.0.13-160000.2.1",
            "qemu-pr-helper": "10.0.13-160000.2.1",
            "qemu-s390x": "10.0.13-160000.2.1",
            "qemu-seabios": "10.0.131.16.3_3_g3d33c746-160000.2.1",
            "qemu-skiboot": "10.0.13-160000.2.1",
            "qemu-spice": "10.0.13-160000.2.1",
            "qemu-tools": "10.0.13-160000.2.1",
            "qemu-ui-curses": "10.0.13-160000.2.1",
            "qemu-ui-dbus": "10.0.13-160000.2.1",
            "qemu-ui-gtk": "10.0.13-160000.2.1",
            "qemu-ui-opengl": "10.0.13-160000.2.1",
            "qemu-ui-spice-app": "10.0.13-160000.2.1",
            "qemu-ui-spice-core": "10.0.13-160000.2.1",
            "qemu-vgabios": "10.0.131.16.3_3_g3d33c746-160000.2.1",
            "qemu-vhost-user-gpu": "10.0.13-160000.2.1",
            "qemu-vmsr-helper": "10.0.13-160000.2.1",
            "qemu-x86": "10.0.13-160000.2.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22047-1.json"