Linux · Security advisory · April 24, 2026
ELSA-2026-50241: Security update for 11 packages
ELSA-2026-50241, released April 24, 2026, fixes 10 CVEs across 11 products. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
10
2 rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0086
58th percentile
Priority of the 10 CVEs
Patch now 0
Urgent 2
High 1
Routine 7
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| qemu-guest-agent | ol 9 | 31:7.2.0-37.el9 |
| qemu-img | ol 9 | 31:7.2.0-37.el9 |
| qemu-kvm | ol 9 | 31:7.2.0-37.el9 |
| qemu-kvm-block-curl | ol 9 | 31:7.2.0-37.el9 |
| qemu-kvm-block-iscsi | ol 9 | 31:7.2.0-37.el9 |
| qemu-kvm-block-rbd | ol 9 | 31:7.2.0-37.el9 |
| qemu-kvm-block-ssh | ol 9 | 31:7.2.0-37.el9 |
| qemu-kvm-common | ol 9 | 31:7.2.0-37.el9 |
| qemu-kvm-core | ol 9 | 31:7.2.0-37.el9 |
| qemu-kvm-device-usb-host | ol 9 | 31:7.2.0-37.el9 |
| qemu-virtiofsd | ol 9 | 31:7.2.0-37.el9 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2024-36350 | AMD: CVE-2024-36350 Transient Scheduler Attack in Store Queue | 7.8 | 0.0049 | Exploitation Less Likely | |
| Urgent | CVE-2024-36357 | AMD: CVE-2024-36357 Transient Scheduler Attack in L1 Data Queue | 7.8 | 0.0036 | Exploitation Less Likely | |
| High | CVE-2025-11234 | Qemu-kvm: vnc websocket handshake use-after-free | 7.5 | 0.0086 | None reported | |
| Routine | CVE-2025-54566 | hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327. | 5.4 | 0.0029 | None reported | |
| Routine | CVE-2025-54567 | hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327. | 5.4 | 0.0029 | None reported | |
| Routine | CVE-2024-8354 | qemu-block-supplemental: A flaw was found in QEMU | 5.5 | 0.0029 | None reported | |
| Routine | CVE-2026-0665 | qemu: An off-by-one error was found in QEMU's KVM Xen guest support | 6.5 | 0.0017 | None reported | |
| Routine | CVE-2025-8860 | qemu: A flaw was found in QEMU in the uefi-vars virtual device | 3.3 | 0.0017 | None reported | |
| Routine | CVE-2025-14876 | qemu: This update for qemu fixes the following issue: - CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (b... | 5.5 | 0.0016 | None reported | |
| Routine | CVE-2026-2243 | Qemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing | 5.1 | 0.0013 | None reported |
Showing 1 to 10 of 10
1