QEMU guest agent letting the hypervisor coordinate with the VM (shutdown, info, freeze).
Version: 11.0.4
Type: Service
License:
| Expand | CVE | Title | Status | |
|---|---|---|---|---|
| CVE-2021-20255 Open CVE-2021-20255 in a new tab | A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controller commands due to a DMA reentry issue. This flaw allows a guest user or process to consume CPU cycles or crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. | Not affected | Medium | |
| CVE-2019-12067 Open CVE-2019-12067 in a new tab | The ahci_commit_buf function in ide/ahci. | Not affected | Low | |
| CVE-2019-12247 Open CVE-2019-12247 in a new tab | QEMU 3. | Not affected | Low | |
| CVE-2019-12928 Open CVE-2019-12928 in a new tab | The QMP migrate command in QEMU version 4. | Not affected | Low | |
| CVE-2019-12929 Open CVE-2019-12929 in a new tab | The QMP guest_exec command in QEMU 4. | Not affected | Low | |
| CVE-2022-36648 Open CVE-2022-36648 in a new tab | The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7. | Not affected | Low | |
| CVE-2023-1386 Open CVE-2023-1386 in a new tab | A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host. | Not affected | Low | |
| CVE-2020-25741 Open CVE-2020-25741 in a new tab | fdctrl_write_data in hw/block/fdc. | Not affected | Unknown | |
| CVE-2020-25742 Open CVE-2020-25742 in a new tab | pci_change_irq_level in hw/pci/pci. | Not affected | Unknown | |
| CVE-2020-25743 Open CVE-2020-25743 in a new tab | hw/ide/pci. | Not affected | Unknown | |
| CVE-2020-35503 Open CVE-2020-35503 in a new tab | A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6. | Not affected | Unknown | |
| CVE-2021-3735 Open CVE-2021-3735 in a new tab | A deadlock issue was found in the AHCI controller device of QEMU. | Not affected | Unknown | |
| CVE-2022-3872 Open CVE-2022-3872 in a new tab | An off-by-one read/write issue was found in the SDHCI device of QEMU. | Not affected | Unknown | |
| CVE-2024-8354 Open CVE-2024-8354 in a new tab | Qemu-kvm: usb: assertion failure in usb_ep_get() | Not affected | Unknown | |
| CVE-2024-8612 Open CVE-2024-8612 in a new tab | Qemu-kvm: information leak in virtio devices | Not affected | Unknown | |
| CVE-2026-12080 Open CVE-2026-12080 in a new tab | Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys | Not affected | Unknown | |
| CVE-2026-16271 Open CVE-2026-16271 in a new tab | CVE-2026-16271 | Not affected | Unknown | |
| CVE-2026-17588 Open CVE-2026-17588 in a new tab | CVE-2026-17588 | Not affected | Unknown | |
| CVE-2026-6426 Open CVE-2026-6426 in a new tab | Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access | Not affected | Unknown | |
| CVE-2026-66020 Open CVE-2026-66020 in a new tab | CVE-2026-66020 | Not affected | Unknown | |
| CVE-2026-66899 Open CVE-2026-66899 in a new tab | CVE-2026-66899 | Not affected | Unknown | |
| CVE-2026-66900 Open CVE-2026-66900 in a new tab | CVE-2026-66900 | Not affected | Unknown | |
| CVE-2026-77913 Open CVE-2026-77913 in a new tab | CVE-2026-77913 | Not affected | Unknown | |
| CVE-2026-81627 Open CVE-2026-81627 in a new tab | Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram | Not affected | Unknown | |
| CVE-2026-84788 Open CVE-2026-84788 in a new tab | CVE-2026-84788 | Not affected | Unknown | |
| CVE-2026-93834 Open CVE-2026-93834 in a new tab | Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape | Not affected | Unknown |
A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controller commands due to a DMA reentry issue. This flaw allows a guest user or process to consume CPU cycles or crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
The ahci_commit_buf function in ide/ahci.
QEMU 3.
The QMP migrate command in QEMU version 4.
The QMP guest_exec command in QEMU 4.
The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host.
fdctrl_write_data in hw/block/fdc.
pci_change_irq_level in hw/pci/pci.
hw/ide/pci.
A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.
A deadlock issue was found in the AHCI controller device of QEMU.
An off-by-one read/write issue was found in the SDHCI device of QEMU.
Qemu-kvm: usb: assertion failure in usb_ep_get()
Qemu-kvm: information leak in virtio devices
Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys
CVE-2026-16271
CVE-2026-17588
Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
CVE-2026-66020
CVE-2026-66899
CVE-2026-66900
CVE-2026-77913
Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram
CVE-2026-84788
Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
Showing 1–26 of 26