Linux · Security advisory · August 19, 2026

ELSA-2026-500220: Security update for 11 packages

ELSA-2026-500220, released August 19, 2026, fixes 11 CVEs across 11 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
11
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0025
16th percentile

Priority of the 11 CVEs

Patch now 0 Urgent 0 High 4 Routine 7

Fixed package versions

ProductReleaseFixed in
qemu-guest-agentol 931:7.2.0-42.el9
qemu-imgol 931:7.2.0-42.el9
qemu-kvmol 931:7.2.0-42.el9
qemu-kvm-block-curlol 931:7.2.0-42.el9
qemu-kvm-block-iscsiol 931:7.2.0-42.el9
qemu-kvm-block-rbdol 931:7.2.0-42.el9
qemu-kvm-block-sshol 931:7.2.0-42.el9
qemu-kvm-commonol 931:7.2.0-42.el9
qemu-kvm-coreol 931:7.2.0-42.el9
qemu-kvm-device-usb-hostol 931:7.2.0-42.el9
qemu-virtiofsdol 931:7.2.0-42.el9

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2024-6519 qemu-system-xen: A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation 8.2 0.0025 None reported
High CVE-2026-48002 qemu vulnerability 7.9 n/a None reported
High CVE-2026-5763 qemu vulnerability 7.8 n/a None reported
High CVE-2026-6425 qemu vulnerability 7.8 n/a None reported
Routine CVE-2024-8612 qemu: This update for qemu fixes the following issues: Security fixes: - CVE-2024-8354: Fixed assertion failure in usb_ep... 3.8 0.0020 None reported
Routine CVE-2026-48914 Qemu-kvm: heap buffer overflow in virtio-blk scsi request handling 6.7 0.0016 None reported
Routine CVE-2026-48003 qemu vulnerability 6.5 n/a None reported
Routine CVE-2026-8348 qemu vulnerability 5.5 n/a None reported
Routine CVE-2026-9238 qemu vulnerability 5.5 n/a None reported
Routine CVE-2026-8343 qemu vulnerability 5.3 n/a None reported
Routine CVE-2026-48004 qemu vulnerability 4.7 n/a None reported
Showing 1 to 11 of 11 1