RHSA-2026:58571: Moderate: qemu-kvm security, bug fix, and enhancement update
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.Security Fix(es): qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling (CVE-2026-48914) Bug Fix(es) and Enhancement(s): qemu-kvm hung during drain after double pause [rhel-10.2.z] (JIRA:RHEL-190702) qemu-img create/convert fails on target block device with 4k sector size [rhel-10.2.z] (JIRA:RHEL-207389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-guest-agentto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-guest-agent-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-imgto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-img-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-audio-dbus-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-audio-pato a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-audio-pa-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-block-blkioto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-block-blkio-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-block-curlto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-block-curl-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-block-rbdto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-block-rbd-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-commonto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-common-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-coreto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-core-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-debugsourceto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-device-display-virtio-gputo a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-device-display-virtio-gpu-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-device-display-virtio-gpu-pcito a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-device-display-virtio-gpu-pci-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-device-display-virtio-vgato a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-device-display-virtio-vga-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-device-usb-hostto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-device-usb-host-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-device-usb-redirectto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-device-usb-redirect-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-docsto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-tests-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-toolsto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-tools-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-ui-dbus-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-ui-egl-headlessto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-ui-egl-headless-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-ui-openglto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-ui-opengl-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-pr-helperto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-pr-helper-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-device-display-virtio-gpu-ccwto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-kvm-device-display-virtio-gpu-ccw-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5 - Upgrade
Upgrade
redhat/qemu-guest-agentto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-guest-agent-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-imgto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-img-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvmto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-audio-dbus-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-audio-pato a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-audio-pa-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-block-blkioto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-block-blkio-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-block-curlto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-block-curl-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-block-rbdto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-block-rbd-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-commonto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-common-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-coreto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-core-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-debugsourceto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-device-display-virtio-gputo a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-device-display-virtio-gpu-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-device-display-virtio-gpu-pcito a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-device-display-virtio-gpu-pci-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-device-usb-hostto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-device-usb-host-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-device-usb-redirectto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-device-usb-redirect-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-docsto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-tests-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-toolsto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-tools-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-kvm-ui-dbus-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-pr-helperto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
redhat/qemu-pr-helper-debuginfoto a version that resolves this vulnerability.Fixed in 10.1.0-16.el10_2.5.aa - Upgrade
Upgrade
qemu-kvmto a version that resolves this vulnerability.Patch CVE-2026-48914 - Upgrade
Upgrade
qemu-kvmto a version that resolves this vulnerability.Fixed in rhel-10.2.zPatch JIRA:RHEL-190702 - Upgrade
Upgrade
qemu-kvmto a version that resolves this vulnerability.Fixed in rhel-10.2.zPatch JIRA:RHEL-207389