Off-by-one in QEMU - CVE-2026-0665

Vulnerability identifier: #VU123559

CSH Severity: Low

CVSS v4: 6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H]

CVE-ID: CVE-2026-0665

CWE-ID: CWE-193

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a malicious guest to perform a denial of service attack.

The vulnerability exists due to an off-by-one error within the KVM Xen guest support in hw/i386/kvm/xen_evtchn.c. A malicious guest can trigger an off-by-one error and perform a denial of service attack. 

QEMU
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Basesystem Module
Server Applications Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
openEuler
qemu (Ubuntu package)
qemu-guest-agent
qemu-help
qemu-user-static
qemu-user-binfmt
qemu-user
qemu-system-x86_64
qemu-system-riscv
qemu-system-arm
qemu-system-aarch64
qemu-img
qemu-hw-usb-host
qemu-debugsource
qemu-debuginfo
qemu-block-ssh
qemu-block-rbd
qemu-block-iscsi
qemu-block-curl
qemu
qemu-seabios
qemu-arm
qemu-block-curl-debuginfo
qemu-linux-user-debuginfo
qemu-extra-debuginfo
qemu-hw-display-virtio-gpu
qemu-ui-gtk
qemu-audio-dbus
qemu-hw-display-qxl
qemu-extra
qemu-s390x
qemu-ui-opengl-debuginfo
qemu-chardev-baum
qemu-chardev-spice
qemu-audio-alsa-debuginfo
qemu-ui-dbus
qemu-ui-curses-debuginfo
qemu-s390x-debuginfo
qemu-audio-oss
qemu-hw-usb-redirect-debuginfo
qemu-chardev-baum-debuginfo
qemu-vhost-user-gpu
qemu-ivshmem-tools
qemu-accel-tcg-x86-debuginfo
qemu-ui-spice-app-debuginfo
qemu-audio-pipewire-debuginfo
qemu-block-nfs
qemu-block-rbd-debuginfo
qemu-ivshmem-tools-debuginfo
qemu-block-iscsi-debuginfo
qemu-arm-debuginfo
qemu-pr-helper-debuginfo
qemu-linux-user
qemu-headless
qemu-hw-display-virtio-vga-debuginfo
qemu-ppc
qemu-audio-alsa
qemu-ui-spice-core
qemu-hw-usb-smartcard
qemu-audio-spice-debuginfo
qemu-hw-display-virtio-gpu-pci
qemu-ppc-debuginfo
qemu-accel-qtest-debuginfo
qemu-audio-jack
qemu-hw-usb-smartcard-debuginfo
qemu-ui-spice-core-debuginfo
qemu-guest-agent-debuginfo
qemu-hw-display-virtio-vga
qemu-img-debuginfo
qemu-block-nfs-debuginfo
qemu-block-gluster-debuginfo
qemu-audio-oss-debuginfo
qemu-tools-debuginfo
qemu-spice
qemu-linux-user-debugsource
qemu-block-gluster
qemu-pr-helper
qemu-hw-display-virtio-gpu-pci-debuginfo
qemu-hw-usb-redirect
qemu-block-dmg
qemu-audio-dbus-debuginfo
qemu-hw-s390x-virtio-gpu-ccw
qemu-audio-jack-debuginfo
qemu-accel-qtest
qemu-ui-spice-app
qemu-ipxe
qemu-microvm
qemu-skiboot
qemu-lang
qemu-doc
qemu-SLOF
qemu-ksm
qemu-block-ssh-debuginfo
qemu-audio-spice
qemu-accel-tcg-x86
qemu-audio-pa-debuginfo
qemu-ui-curses
qemu-x86
qemu-audio-pipewire
qemu-tools
qemu-chardev-spice-debuginfo
qemu-ui-gtk-debuginfo
qemu-hw-display-virtio-gpu-debuginfo
qemu-ui-dbus-debuginfo
qemu-x86-debuginfo
qemu-ui-opengl
qemu-vhost-user-gpu-debuginfo
qemu-hw-usb-host-debuginfo
qemu-audio-pa
qemu-block-dmg-debuginfo
qemu-hw-s390x-virtio-gpu-ccw-debuginfo
qemu-hw-display-qxl-debuginfo
qemu-vgabios
qemu-vmsr-helper-debuginfo
qemu-vmsr-helper

Install updates from vendor's website.

QEMU - addressed in versions 10.0.8, 10.1.4, 10.2.1
qemu (Ubuntu package) - addressed in versions 1:6.2+dfsg-2ubuntu6.28, 1:8.2.2+ds-0ubuntu1.13, 1:10.1.0+ds-5ubuntu2.4
qemu-guest-agent - update to 8.2.0-67
qemu-help - update to 8.2.0-67
qemu-user-static - update to 8.2.0-67
qemu-user-binfmt - update to 8.2.0-67
qemu-user - update to 8.2.0-67
qemu-system-x86_64 - update to 8.2.0-67
qemu-system-riscv - update to 8.2.0-67
qemu-system-arm - update to 8.2.0-67
qemu-system-aarch64 - update to 8.2.0-67
qemu-img - update to 8.2.0-67
qemu-hw-usb-host - update to 8.2.0-67
qemu-debugsource - update to 8.2.0-67
qemu-debuginfo - update to 8.2.0-67
qemu-block-ssh - update to 8.2.0-67
qemu-block-rbd - update to 8.2.0-67
qemu-block-iscsi - update to 8.2.0-67
qemu-block-curl - update to 8.2.0-67
qemu - update to 8.2.0-67
qemu-seabios - update to 8.2.0-67
qemu-arm - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-curl-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-linux-user-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-extra-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-display-virtio-gpu - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ui-gtk - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-dbus - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-display-qxl - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-extra - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-s390x - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ui-opengl-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-chardev-baum - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-chardev-spice - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-alsa-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ui-dbus - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-usb-host - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ui-curses-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-s390x-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-oss - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-usb-redirect-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-chardev-baum-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-vhost-user-gpu - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ivshmem-tools - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-accel-tcg-x86-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ui-spice-app-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-pipewire-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-nfs - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-rbd-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ivshmem-tools-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-debugsource - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-iscsi-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-img - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-arm-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-curl - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-pr-helper-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-linux-user - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-headless - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-display-virtio-vga-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ppc - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-alsa - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ui-spice-core - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-usb-smartcard - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-spice-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-display-virtio-gpu-pci - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ppc-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-accel-qtest-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-jack - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-usb-smartcard-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ui-spice-core-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-guest-agent-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-display-virtio-vga - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-img-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-nfs-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-gluster-debuginfo - update to 8.2.10-150600.3.46.1
qemu-audio-oss-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-tools-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-spice - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-linux-user-debugsource - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-gluster - update to 8.2.10-150600.3.46.1
qemu-pr-helper - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-iscsi - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-display-virtio-gpu-pci-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-usb-redirect - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-dmg - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-dbus-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-s390x-virtio-gpu-ccw - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-jack-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-accel-qtest - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ui-spice-app - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ipxe - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-microvm - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-skiboot - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-lang - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-doc - update to 8.2.10-150600.3.46.1
qemu-SLOF - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-rbd - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-guest-agent - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ksm - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-ssh-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-spice - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-accel-tcg-x86 - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-pa-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ui-curses - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-x86 - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-pipewire - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-tools - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-chardev-spice-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ui-gtk-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-display-virtio-gpu-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ui-dbus-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-x86-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-ui-opengl - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-vhost-user-gpu-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-usb-host-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-audio-pa - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-ssh - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-block-dmg-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-s390x-virtio-gpu-ccw-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-hw-display-qxl-debuginfo - addressed in versions 8.2.10-150600.3.46.1, 9.2.4-150700.3.14.1
qemu-vgabios - addressed in versions 8.2.101.16.3_3_ga95067eb-150600.3.46.1, 9.2.41.16.3_3_g3d33c746-150700.3.14.1
qemu-seabios - addressed in versions 8.2.101.16.3_3_ga95067eb-150600.3.46.1, 9.2.41.16.3_3_g3d33c746-150700.3.14.1
qemu-vmsr-helper-debuginfo - update to 9.2.4-150700.3.14.1
qemu-vmsr-helper - update to 9.2.4-150700.3.14.1

• https://bugzilla.redhat.com/show_bug.cgi?id=2428640
• https://gitlab.com/qemu-project/qemu/-/commit/c7504ba2a560fd884557f6e5142f03b491aad0c7

• Multiple vulnerabilities in QEMU
• Ubuntu update for qemu
• openEuler 24.03 LTS SP3 update for qemu
• SUSE update for qemu
• SUSE update for qemu