Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-4009
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
FAQs regarding Amazon Linux ALAS/CVE Severity
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba (v11.1.0-rc3)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/5fbd2fe1cc54259d045d00d4966aa2db1ba990d6 (v11.0.4) (CVE-2026-18054)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3917
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/0be94d8d9c28e6b7235b34133d057090fe93be6c (v11.1.0-rc2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/88a0e5e45b41d407cf9adf1f2cf6f20f394a578d (v11.0.4) (CVE-2026-50624)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3875
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f404bf0e6504e0412a00ea64708f17d2a5e3f869 (v11.1.0-rc2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/a4abe1f1fa6f465b64fb400bea14c72bd5e32ac9 (v11.0.4) (CVE-2026-61476)
QEMU's 9pfs readonly check at line 2108-2109 tests mode & O_TRUNC and mode & O_APPEND against the raw 9P open mode byte. For the 9P2000.u protocol, mode uses 9P flag values (Otrunc=0x10, Oappend=0x80), but the check compares against Linux constants (O_TRUNC=0x200, O_APPEND=0x400). Since 0x10 & 0x200 = 0 and 0x80 & 0x400 = 0, both flags bypass the readonly guard. The mode is then correctly converted to host flags via omode_to_uflags(), so open() is called with O_TRUNC -- truncating host files on readonly shares.
9P2000.L is NOT affected (guest passes Linux flags directly, so the bit values match). (CVE-2026-63318)
Host-side AddressSanitizer heap-buffer-overflow READ in current QEMU master through the virtio-net-pci receive filtering path on q35. The crash is in receive_filter(). (CVE-2026-63320)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3607
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/4727cc883b7e81d2c30b9801af54482d65b84292 (v11.1.0-rc2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/95b9a1bf26fef7c44f4925f78ade7fa824ed5e76 (v11.0.4) (CVE-2026-63322)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3846
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/370882d0869567e5f21b95229a763171e319d0db (v11.1.0-rc3)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/e00b9c9193de00f5782cb919d91eb80d255017fe (v11.0.4) (CVE-2026-65928)
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory. (CVE-2026-81627)
Affected Packages:
qemu
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update qemu or yum update --advisory ALAS2-2026-4009 to update your system.
aarch64:
qemu-3.1.0-8.amzn2.0.28.aarch64
qemu-common-3.1.0-8.amzn2.0.28.aarch64
qemu-guest-agent-3.1.0-8.amzn2.0.28.aarch64
qemu-img-3.1.0-8.amzn2.0.28.aarch64
ivshmem-tools-3.1.0-8.amzn2.0.28.aarch64
qemu-block-curl-3.1.0-8.amzn2.0.28.aarch64
qemu-block-dmg-3.1.0-8.amzn2.0.28.aarch64
qemu-block-iscsi-3.1.0-8.amzn2.0.28.aarch64
qemu-block-nfs-3.1.0-8.amzn2.0.28.aarch64
qemu-block-rbd-3.1.0-8.amzn2.0.28.aarch64
qemu-block-ssh-3.1.0-8.amzn2.0.28.aarch64
qemu-audio-alsa-3.1.0-8.amzn2.0.28.aarch64
qemu-audio-oss-3.1.0-8.amzn2.0.28.aarch64
qemu-audio-pa-3.1.0-8.amzn2.0.28.aarch64
qemu-audio-sdl-3.1.0-8.amzn2.0.28.aarch64
qemu-ui-curses-3.1.0-8.amzn2.0.28.aarch64
qemu-ui-gtk-3.1.0-8.amzn2.0.28.aarch64
qemu-ui-sdl-3.1.0-8.amzn2.0.28.aarch64
qemu-kvm-3.1.0-8.amzn2.0.28.aarch64
qemu-kvm-core-3.1.0-8.amzn2.0.28.aarch64
qemu-user-3.1.0-8.amzn2.0.28.aarch64
qemu-user-binfmt-3.1.0-8.amzn2.0.28.aarch64
qemu-user-static-3.1.0-8.amzn2.0.28.aarch64
qemu-system-aarch64-3.1.0-8.amzn2.0.28.aarch64
qemu-system-aarch64-core-3.1.0-8.amzn2.0.28.aarch64
qemu-system-x86-3.1.0-8.amzn2.0.28.aarch64
qemu-system-x86-core-3.1.0-8.amzn2.0.28.aarch64
qemu-debuginfo-3.1.0-8.amzn2.0.28.aarch64
src:
qemu-3.1.0-8.amzn2.0.28.src
x86_64:
qemu-3.1.0-8.amzn2.0.28.x86_64
qemu-common-3.1.0-8.amzn2.0.28.x86_64
qemu-guest-agent-3.1.0-8.amzn2.0.28.x86_64
qemu-img-3.1.0-8.amzn2.0.28.x86_64
ivshmem-tools-3.1.0-8.amzn2.0.28.x86_64
qemu-block-curl-3.1.0-8.amzn2.0.28.x86_64
qemu-block-dmg-3.1.0-8.amzn2.0.28.x86_64
qemu-block-iscsi-3.1.0-8.amzn2.0.28.x86_64
qemu-block-nfs-3.1.0-8.amzn2.0.28.x86_64
qemu-block-rbd-3.1.0-8.amzn2.0.28.x86_64
qemu-block-ssh-3.1.0-8.amzn2.0.28.x86_64
qemu-audio-alsa-3.1.0-8.amzn2.0.28.x86_64
qemu-audio-oss-3.1.0-8.amzn2.0.28.x86_64
qemu-audio-pa-3.1.0-8.amzn2.0.28.x86_64
qemu-audio-sdl-3.1.0-8.amzn2.0.28.x86_64
qemu-ui-curses-3.1.0-8.amzn2.0.28.x86_64
qemu-ui-gtk-3.1.0-8.amzn2.0.28.x86_64
qemu-ui-sdl-3.1.0-8.amzn2.0.28.x86_64
qemu-kvm-3.1.0-8.amzn2.0.28.x86_64
qemu-kvm-core-3.1.0-8.amzn2.0.28.x86_64
qemu-user-3.1.0-8.amzn2.0.28.x86_64
qemu-user-binfmt-3.1.0-8.amzn2.0.28.x86_64
qemu-user-static-3.1.0-8.amzn2.0.28.x86_64
qemu-system-aarch64-3.1.0-8.amzn2.0.28.x86_64
qemu-system-aarch64-core-3.1.0-8.amzn2.0.28.x86_64
qemu-system-x86-3.1.0-8.amzn2.0.28.x86_64
qemu-system-x86-core-3.1.0-8.amzn2.0.28.x86_64
qemu-debuginfo-3.1.0-8.amzn2.0.28.x86_64