openSUSE-SU-2026:22047-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22047-1.json

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22047-1

Upstream

CVE (2)

CVE-2026-81627
CVE-2026-93834

Related

CVE (2)

CVE-2026-81627
CVE-2026-93834

Published

2026-10-07T09:59:52Z

Modified

2026-10-19T17:23:10Z

Summary

Security update for qemu

Details

This update for qemu fixes the following issues:

Security issues fixed:

CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to bypass chipset D_LCK protection and injecting code into System Management Mode memory (bsc#1282077).
CVE-2026-93834: hw/9pfs: mutate FID path from main thread only (bsc#1282578).

Changes for qemu:

Bugfixes:

[openSUSE][RPM] spec: drop qemu-ipxe Requires for ppc (bsc#1282918)
virtio: fix queue size validation against allocated maximum (bsc#1279962)
virtio-mmio: fix QUEUE_NUM_MAX (bsc#1279962)
target/ppc/kvm: Use host compatibility mode for nested guests (bsc#1263864)
target/ppc/kvm: Add support for querying host compatibility mode (bsc#1263864)
linux-headers: Update to include KVM_CAP_PPC_COMPAT_CAPS (bsc#1263864)
linux-headers: Update to Linux v7.2-rc1 with KVM_S390_VM_CPU_FEAT_ASTFLEIE2 (bsc#1263864)
linux-headers: Update to Linux v7.1-rc4 (bsc#1263864)
scripts/update-linux-headers: Add typelimits.h (bsc#1263864)
update-linux-headers: Inject VIRTIO_RING_NO_LEGACY in virtio_ring.h (bsc#1263864)
linux-headers: Add nitro_enclaves.h (bsc#1263864)
scripts/update-linux-headers: Add Nitro Enclaves header (bsc#1263864)
standard-headers: Update virtio_spi.h from Linux v6.18-rc3 (bsc#1263864)
linux-headers: Update to Linux v6.19-rc1 (bsc#1263864)
update-linux-headers: Remove "asm-s390/unistd_32.h" (bsc#1263864)
linux-headers: Update to Linux v6.18-rc3 (bsc#1263864)
linux-headers/linux: Add mshv.h headers (bsc#1263864)
include/hw/hyperv: Add MSHV ABI header definitions (bsc#1263864)
linux-headers: Update to Linux v6.17-rc1 (bsc#1263864)
linux-headers: deal with counted_by annotation (bsc#1263864)
linux-headers: Remove the 32-bit arm headers (bsc#1263864)
update Linux headers to KVM tree master (bsc#1263864)

References

Affected packages

openSUSE:Leap 16.0 / qemu

Package

Name: qemu
Purl: pkg:rpm/opensuse/qemu&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.0.13-160000.2.1

Ecosystem specific

{
    "binaries":  [
        {
            "qemu":  "10.0.13-160000.2.1",
            "qemu-SLOF":  "10.0.13-160000.2.1",
            "qemu-accel-qtest":  "10.0.13-160000.2.1",
            "qemu-arm":  "10.0.13-160000.2.1",
            "qemu-audio-alsa":  "10.0.13-160000.2.1",
            "qemu-audio-dbus":  "10.0.13-160000.2.1",
            "qemu-audio-jack":  "10.0.13-160000.2.1",
            "qemu-audio-oss":  "10.0.13-160000.2.1",
            "qemu-audio-pa":  "10.0.13-160000.2.1",
            "qemu-audio-pipewire":  "10.0.13-160000.2.1",
            "qemu-audio-spice":  "10.0.13-160000.2.1",
            "qemu-block-curl":  "10.0.13-160000.2.1",
            "qemu-block-dmg":  "10.0.13-160000.2.1",
            "qemu-block-iscsi":  "10.0.13-160000.2.1",
            "qemu-block-nfs":  "10.0.13-160000.2.1",
            "qemu-block-rbd":  "10.0.13-160000.2.1",
            "qemu-block-ssh":  "10.0.13-160000.2.1",
            "qemu-chardev-baum":  "10.0.13-160000.2.1",
            "qemu-chardev-spice":  "10.0.13-160000.2.1",
            "qemu-doc":  "10.0.13-160000.2.1",
            "qemu-extra":  "10.0.13-160000.2.1",
            "qemu-guest-agent":  "10.0.13-160000.2.1",
            "qemu-headless":  "10.0.13-160000.2.1",
            "qemu-hw-display-qxl":  "10.0.13-160000.2.1",
            "qemu-hw-display-virtio-gpu":  "10.0.13-160000.2.1",
            "qemu-hw-display-virtio-gpu-pci":  "10.0.13-160000.2.1",
            "qemu-hw-display-virtio-vga":  "10.0.13-160000.2.1",
            "qemu-hw-s390x-virtio-gpu-ccw":  "10.0.13-160000.2.1",
            "qemu-hw-usb-host":  "10.0.13-160000.2.1",
            "qemu-hw-usb-redirect":  "10.0.13-160000.2.1",
            "qemu-hw-usb-smartcard":  "10.0.13-160000.2.1",
            "qemu-img":  "10.0.13-160000.2.1",
            "qemu-ipxe":  "10.0.13-160000.2.1",
            "qemu-ivshmem-tools":  "10.0.13-160000.2.1",
            "qemu-ksm":  "10.0.13-160000.2.1",
            "qemu-lang":  "10.0.13-160000.2.1",
            "qemu-linux-user":  "10.0.13-160000.2.1",
            "qemu-microvm":  "10.0.13-160000.2.1",
            "qemu-ppc":  "10.0.13-160000.2.1",
            "qemu-pr-helper":  "10.0.13-160000.2.1",
            "qemu-s390x":  "10.0.13-160000.2.1",
            "qemu-seabios":  "10.0.131.16.3_3_g3d33c746-160000.2.1",
            "qemu-skiboot":  "10.0.13-160000.2.1",
            "qemu-spice":  "10.0.13-160000.2.1",
            "qemu-tools":  "10.0.13-160000.2.1",
            "qemu-ui-curses":  "10.0.13-160000.2.1",
            "qemu-ui-dbus":  "10.0.13-160000.2.1",
            "qemu-ui-gtk":  "10.0.13-160000.2.1",
            "qemu-ui-opengl":  "10.0.13-160000.2.1",
            "qemu-ui-spice-app":  "10.0.13-160000.2.1",
            "qemu-ui-spice-core":  "10.0.13-160000.2.1",
            "qemu-vgabios":  "10.0.131.16.3_3_g3d33c746-160000.2.1",
            "qemu-vhost-user-gpu":  "10.0.13-160000.2.1",
            "qemu-vmsr-helper":  "10.0.13-160000.2.1",
            "qemu-x86":  "10.0.13-160000.2.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22047-1.json"

openSUSE:Leap 16.0 / qemu-linux-user

Package

Name: qemu-linux-user
Purl: pkg:rpm/opensuse/qemu-linux-user&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.0.13-160000.2.1

Ecosystem specific

{
    "binaries":  [
        {
            "qemu":  "10.0.13-160000.2.1",
            "qemu-SLOF":  "10.0.13-160000.2.1",
            "qemu-accel-qtest":  "10.0.13-160000.2.1",
            "qemu-arm":  "10.0.13-160000.2.1",
            "qemu-audio-alsa":  "10.0.13-160000.2.1",
            "qemu-audio-dbus":  "10.0.13-160000.2.1",
            "qemu-audio-jack":  "10.0.13-160000.2.1",
            "qemu-audio-oss":  "10.0.13-160000.2.1",
            "qemu-audio-pa":  "10.0.13-160000.2.1",
            "qemu-audio-pipewire":  "10.0.13-160000.2.1",
            "qemu-audio-spice":  "10.0.13-160000.2.1",
            "qemu-block-curl":  "10.0.13-160000.2.1",
            "qemu-block-dmg":  "10.0.13-160000.2.1",
            "qemu-block-iscsi":  "10.0.13-160000.2.1",
            "qemu-block-nfs":  "10.0.13-160000.2.1",
            "qemu-block-rbd":  "10.0.13-160000.2.1",
            "qemu-block-ssh":  "10.0.13-160000.2.1",
            "qemu-chardev-baum":  "10.0.13-160000.2.1",
            "qemu-chardev-spice":  "10.0.13-160000.2.1",
            "qemu-doc":  "10.0.13-160000.2.1",
            "qemu-extra":  "10.0.13-160000.2.1",
            "qemu-guest-agent":  "10.0.13-160000.2.1",
            "qemu-headless":  "10.0.13-160000.2.1",
            "qemu-hw-display-qxl":  "10.0.13-160000.2.1",
            "qemu-hw-display-virtio-gpu":  "10.0.13-160000.2.1",
            "qemu-hw-display-virtio-gpu-pci":  "10.0.13-160000.2.1",
            "qemu-hw-display-virtio-vga":  "10.0.13-160000.2.1",
            "qemu-hw-s390x-virtio-gpu-ccw":  "10.0.13-160000.2.1",
            "qemu-hw-usb-host":  "10.0.13-160000.2.1",
            "qemu-hw-usb-redirect":  "10.0.13-160000.2.1",
            "qemu-hw-usb-smartcard":  "10.0.13-160000.2.1",
            "qemu-img":  "10.0.13-160000.2.1",
            "qemu-ipxe":  "10.0.13-160000.2.1",
            "qemu-ivshmem-tools":  "10.0.13-160000.2.1",
            "qemu-ksm":  "10.0.13-160000.2.1",
            "qemu-lang":  "10.0.13-160000.2.1",
            "qemu-linux-user":  "10.0.13-160000.2.1",
            "qemu-microvm":  "10.0.13-160000.2.1",
            "qemu-ppc":  "10.0.13-160000.2.1",
            "qemu-pr-helper":  "10.0.13-160000.2.1",
            "qemu-s390x":  "10.0.13-160000.2.1",
            "qemu-seabios":  "10.0.131.16.3_3_g3d33c746-160000.2.1",
            "qemu-skiboot":  "10.0.13-160000.2.1",
            "qemu-spice":  "10.0.13-160000.2.1",
            "qemu-tools":  "10.0.13-160000.2.1",
            "qemu-ui-curses":  "10.0.13-160000.2.1",
            "qemu-ui-dbus":  "10.0.13-160000.2.1",
            "qemu-ui-gtk":  "10.0.13-160000.2.1",
            "qemu-ui-opengl":  "10.0.13-160000.2.1",
            "qemu-ui-spice-app":  "10.0.13-160000.2.1",
            "qemu-ui-spice-core":  "10.0.13-160000.2.1",
            "qemu-vgabios":  "10.0.131.16.3_3_g3d33c746-160000.2.1",
            "qemu-vhost-user-gpu":  "10.0.13-160000.2.1",
            "qemu-vmsr-helper":  "10.0.13-160000.2.1",
            "qemu-x86":  "10.0.13-160000.2.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22047-1.json"