CVE-2024-26328
Fixed in a distro release EPSS <1%CVSS 6.0
An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interaction with hw/nvme/ctrl.c is mishandled.
Products: qemu
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | qemu | 1:7.2+dfsg-7+deb12u6 |
| Debian 13 | qemu | 1:8.2.3+ds-1 |
| Debian 14 | qemu | 1:8.2.3+ds-1 |
| SUSE Linux Enterprise Micro 5.5 | qemu | 7.1.0-150500.49.12.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | qemu | 7.1.0-150500.49.12.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | qemu | 7.1.0-150500.49.12.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP5 | qemu | 7.1.0-150500.49.12.1 |
| SUSE Linux Micro 6.0 | qemu | 8.2.5-1.1 |
| Ubuntu 24.04 LTS | qemu | 1:8.2.2+ds-0ubuntu1.2 |
| openSUSE Leap 15.5 | qemu | 7.1.0-150500.49.12.1 |
| openSUSE Tumbleweed | qemu | 8.2.2-2.1 |