CVE-2026-24708

Name	CVE-2026-24708
Description	An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4486-1, DSA-6145-1
Debian Bugs	1128294

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nova (PTS)	bullseye	2:22.0.1-2+deb11u1	vulnerable
	bullseye (security)	2:22.4.0-1~deb11u7	fixed
	bookworm	2:26.2.2-1~deb12u3	vulnerable
	bookworm (security)	2:26.2.2-1~deb12u4	fixed
	trixie	2:31.0.0-6+deb13u1	vulnerable
	trixie (security)	2:31.0.0-6+deb13u2	fixed
	forky, sid	2:32.1.0-7	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
nova	source	bullseye	2:22.4.0-1~deb11u7	DLA-4486-1
nova	source	bookworm	2:26.2.2-1~deb12u4	DSA-6145-1
nova	source	trixie	2:31.0.0-6+deb13u2	DSA-6145-1
nova	source	(unstable)	2:32.1.0-7		1128294

https://www.openwall.com/lists/oss-security/2026/02/17/7
https://review.opendev.org/977100