Linux · Amazon Linux · Security advisory · November 7, 2026

ALAS2023-2026-3241: Security update for 32 packages

ALAS2023-2026-3241, released November 7, 2026, fixes 15 CVEs across 32 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
15
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0041
35th percentile

Priority of the 15 CVEs

Patch now 0 Urgent 0 High 12 Routine 3

Fixed package versions

ProductReleaseFixed in
qemuamzn 20232:11.0.0-4.amzn2023
qemu-commonamzn 20232:11.0.0-4.amzn2023
qemu-common-debuginfoamzn 20232:11.0.0-4.amzn2023
qemu-debuginfoamzn 20232:11.0.0-4.amzn2023
qemu-debugsourceamzn 20232:11.0.0-4.amzn2023
qemu-docsamzn 20232:11.0.0-4.amzn2023
qemu-guest-agentamzn 20232:11.0.0-4.amzn2023
qemu-guest-agent-debuginfoamzn 20232:11.0.0-4.amzn2023
qemu-imgamzn 20232:11.0.0-4.amzn2023
qemu-img-debuginfoamzn 20232:11.0.0-4.amzn2023
qemu-kvmamzn 20232:11.0.0-4.amzn2023
qemu-kvm-coreamzn 20232:11.0.0-4.amzn2023
qemu-pr-helperamzn 20232:11.0.0-4.amzn2023
qemu-pr-helper-debuginfoamzn 20232:11.0.0-4.amzn2023
qemu-system-aarch64amzn 20232:11.0.0-4.amzn2023
qemu-system-aarch64-coreamzn 20232:11.0.0-4.amzn2023
qemu-system-aarch64-core-debuginfoamzn 20232:11.0.0-4.amzn2023
qemu-system-x86amzn 20232:11.0.0-4.amzn2023
qemu-system-x86-coreamzn 20232:11.0.0-4.amzn2023
qemu-system-x86-core-debuginfoamzn 20232:11.0.0-4.amzn2023
qemu-testsamzn 20232:11.0.0-4.amzn2023
qemu-tests-debuginfoamzn 20232:11.0.0-4.amzn2023
qemu-toolsamzn 20232:11.0.0-4.amzn2023
qemu-tools-debuginfoamzn 20232:11.0.0-4.amzn2023
qemu-useramzn 20232:11.0.0-4.amzn2023
qemu-user-binfmtamzn 20232:11.0.0-4.amzn2023
qemu-user-debuginfoamzn 20232:11.0.0-4.amzn2023
qemu-user-staticamzn 20232:11.0.0-4.amzn2023
qemu-user-static-aarch64amzn 20232:11.0.0-4.amzn2023
qemu-user-static-aarch64-debuginfoamzn 20232:11.0.0-4.amzn2023
qemu-user-static-x86amzn 20232:11.0.0-4.amzn2023
qemu-user-static-x86-debuginfoamzn 20232:11.0.0-4.amzn2023

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-93834 Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape8.8 0.0041 None reported
High CVE-2026-81627 Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram8.2 0.0019 None reported
High CVE-2026-17588 qemu vulnerabilityn/a n/a None reported
High CVE-2026-18054 qemu vulnerabilityn/a n/a None reported
High CVE-2026-50624 qemu vulnerabilityn/a n/a None reported
High CVE-2026-61476 qemu vulnerabilityn/a n/a None reported
High CVE-2026-63321 qemu vulnerabilityn/a n/a None reported
High CVE-2026-63322 qemu vulnerabilityn/a n/a None reported
High CVE-2026-66899 qemu vulnerabilityn/a n/a None reported
High CVE-2026-66900 qemu vulnerabilityn/a n/a None reported
High CVE-2026-77913 qemu vulnerabilityn/a n/a None reported
High CVE-2026-84788 qemu vulnerabilityn/a n/a None reported
Routine CVE-2026-63320 qemu vulnerability5.3 n/a None reported
Routine CVE-2026-61402 qemu vulnerability5.1 n/a None reported
Routine CVE-2026-63110 qemu vulnerability3.4 n/a None reported
Showing 1 to 15 of 15 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.