CVE-2026-3842

Name	CVE-2026-3842
Description	A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physical_memory_map() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects, potentially causing information disclosure, data integrity issues, or a denial of service.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qemu (PTS)	bullseye	1:5.2+dfsg-11+deb11u3	fixed
	bullseye (security)	1:5.2+dfsg-11+deb11u5	fixed
	bookworm	1:7.2+dfsg-7+deb12u18	vulnerable
	bookworm (security)	1:7.2+dfsg-7+deb12u15	vulnerable
	trixie	1:10.0.11+ds-0+deb13u1	fixed
	trixie (security)	1:10.0.2+ds-2+deb13u1	vulnerable
	forky, sid	1:11.0.2+ds-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
qemu	source	bullseye	(not affected)
qemu	source	trixie	1:10.0.10+ds-0+deb13u1
qemu	source	(unstable)	1:10.2.2+ds-1

Notes

[bookworm] - qemu <no-dsa> (Minor issue)
[bullseye] - qemu <not-affected> (Synthetic Debugging introduced in v7.1.0)
Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/85af4e937016ed2f20122eb116597d1abb30c5c0 (v10.2.2)