openSUSE-SU-2026:21253-1

Описание

This update for qemu fixes the following issues:

Update to version 10.0.11.

Security issues fixed:

• CVE-2026-3886: integer overflow leading to privilege escalation due to lack of proper validation of user-supplied data in the virtio-gpu driver (bsc#1268061).
• CVE-2026-48914: heap buffer overflow due to improper size validation in virtio-blk SCSI request handling (bsc#1268794).
• CVE-2026-48004: heap use-after-free race condition due to missing rename lock in v9fs_co_readdir_many (bsc#1270133).

Other updates and bugfixes:

• Version 10.0.11:
  • Full backport list here: https://lore.kernel.org/qemu-devel/20260627082646.D825717AB67@think4mjt.localdomain/
• Version 10.0.10:
  • Full backport list here: https://lore.kernel.org/qemu-devel/20260528061820.CEE521691A9@think4mjt.localdomain/
• ppc/spapr: Skip system reset for quiesced CPUs (bsc#1268279).
• i386/tdx: handle TDG.VP.VMCALL (jsc#PED-9266).
• i386/tdx: handle TDG.VP.VMCALL (jsc#PED-9266).
• update Linux headers to v6.16-rc3 (jsc#PED-9266).
• i386/cpu: Warn about why CPUID_EXT_PDCM is not available (jsc#PED-9266).
• i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[] check (jsc#PED-9266).
• [openSUSE] qemu-ga: fix service file against no-autostart (bsc#1199023).