ALAS2-2026-4027

Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-4027
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26
Severity: Important
Issue Overview:

hw/display/qxl: validate primary surface stride against width (CVE-2026-16271)

hw/usb/hcd-xhci: Set reentrancy guard in timer functions (CVE-2026-17588)

hw/display/vga: fix text-mode OOB write after a graphics surface switch (CVE-2026-77913)

io/channel-socket: do not treat a zero length write as an error (CVE-2026-84788)

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user. (CVE-2026-93834)


Affected Packages:

qemu


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update qemu or yum update --advisory ALAS2-2026-4027 to update your system.

New Packages:
aarch64:
    qemu-3.1.0-8.amzn2.0.29.aarch64
    qemu-common-3.1.0-8.amzn2.0.29.aarch64
    qemu-guest-agent-3.1.0-8.amzn2.0.29.aarch64
    qemu-img-3.1.0-8.amzn2.0.29.aarch64
    ivshmem-tools-3.1.0-8.amzn2.0.29.aarch64
    qemu-block-curl-3.1.0-8.amzn2.0.29.aarch64
    qemu-block-dmg-3.1.0-8.amzn2.0.29.aarch64
    qemu-block-iscsi-3.1.0-8.amzn2.0.29.aarch64
    qemu-block-nfs-3.1.0-8.amzn2.0.29.aarch64
    qemu-block-rbd-3.1.0-8.amzn2.0.29.aarch64
    qemu-block-ssh-3.1.0-8.amzn2.0.29.aarch64
    qemu-audio-alsa-3.1.0-8.amzn2.0.29.aarch64
    qemu-audio-oss-3.1.0-8.amzn2.0.29.aarch64
    qemu-audio-pa-3.1.0-8.amzn2.0.29.aarch64
    qemu-audio-sdl-3.1.0-8.amzn2.0.29.aarch64
    qemu-ui-curses-3.1.0-8.amzn2.0.29.aarch64
    qemu-ui-gtk-3.1.0-8.amzn2.0.29.aarch64
    qemu-ui-sdl-3.1.0-8.amzn2.0.29.aarch64
    qemu-kvm-3.1.0-8.amzn2.0.29.aarch64
    qemu-kvm-core-3.1.0-8.amzn2.0.29.aarch64
    qemu-user-3.1.0-8.amzn2.0.29.aarch64
    qemu-user-binfmt-3.1.0-8.amzn2.0.29.aarch64
    qemu-user-static-3.1.0-8.amzn2.0.29.aarch64
    qemu-system-aarch64-3.1.0-8.amzn2.0.29.aarch64
    qemu-system-aarch64-core-3.1.0-8.amzn2.0.29.aarch64
    qemu-system-x86-3.1.0-8.amzn2.0.29.aarch64
    qemu-system-x86-core-3.1.0-8.amzn2.0.29.aarch64
    qemu-debuginfo-3.1.0-8.amzn2.0.29.aarch64

src:
    qemu-3.1.0-8.amzn2.0.29.src

x86_64:
    qemu-3.1.0-8.amzn2.0.29.x86_64
    qemu-common-3.1.0-8.amzn2.0.29.x86_64
    qemu-guest-agent-3.1.0-8.amzn2.0.29.x86_64
    qemu-img-3.1.0-8.amzn2.0.29.x86_64
    ivshmem-tools-3.1.0-8.amzn2.0.29.x86_64
    qemu-block-curl-3.1.0-8.amzn2.0.29.x86_64
    qemu-block-dmg-3.1.0-8.amzn2.0.29.x86_64
    qemu-block-iscsi-3.1.0-8.amzn2.0.29.x86_64
    qemu-block-nfs-3.1.0-8.amzn2.0.29.x86_64
    qemu-block-rbd-3.1.0-8.amzn2.0.29.x86_64
    qemu-block-ssh-3.1.0-8.amzn2.0.29.x86_64
    qemu-audio-alsa-3.1.0-8.amzn2.0.29.x86_64
    qemu-audio-oss-3.1.0-8.amzn2.0.29.x86_64
    qemu-audio-pa-3.1.0-8.amzn2.0.29.x86_64
    qemu-audio-sdl-3.1.0-8.amzn2.0.29.x86_64
    qemu-ui-curses-3.1.0-8.amzn2.0.29.x86_64
    qemu-ui-gtk-3.1.0-8.amzn2.0.29.x86_64
    qemu-ui-sdl-3.1.0-8.amzn2.0.29.x86_64
    qemu-kvm-3.1.0-8.amzn2.0.29.x86_64
    qemu-kvm-core-3.1.0-8.amzn2.0.29.x86_64
    qemu-user-3.1.0-8.amzn2.0.29.x86_64
    qemu-user-binfmt-3.1.0-8.amzn2.0.29.x86_64
    qemu-user-static-3.1.0-8.amzn2.0.29.x86_64
    qemu-system-aarch64-3.1.0-8.amzn2.0.29.x86_64
    qemu-system-aarch64-core-3.1.0-8.amzn2.0.29.x86_64
    qemu-system-x86-3.1.0-8.amzn2.0.29.x86_64
    qemu-system-x86-core-3.1.0-8.amzn2.0.29.x86_64
    qemu-debuginfo-3.1.0-8.amzn2.0.29.x86_64

Additional References

Red Hat: CVE-2026-16271, CVE-2026-17588, CVE-2026-77913, CVE-2026-84788, CVE-2026-93834

Mitre: CVE-2026-16271, CVE-2026-17588, CVE-2026-77913, CVE-2026-84788, CVE-2026-93834