A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8073-1 advisory.

    It was discovered that the UHCI controller implementation of QEMU could be brought into an invalid state.
    An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial     of service. (CVE-2024-8354)

    It was discovered that QEMU incorrectly handled memory during certain VNC operations. An remote attacker     could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2025-11234)

    It was discovered that the e1000 network device implementation of QEMU could be made to write out of     bounds. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a     denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and     Ubuntu 25.10. (CVE-2025-12464)

    It was discovered that the virtio-crypto device implementation of QEMU did not limit the length of a     certain path input. An attacker inside the guest could possibly use this issue to cause QEMU to consume     large amount of memory, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and     Ubuntu 25.10. (CVE-2025-14876)

    It was discovered that the KVM Xen guest support of QEMU could be made to read out of bounds. An attacker     inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service.
    This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-0665)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50118 advisory.

    - Limit recursion in ri-records (CVE-2021-3622)       resolves: rhbz#1976194
    - Bounds check for block exceeding page length (CVE-2021-3504)       resolves: rhbz#1950501
    - Fixes: CVE-2022-40284
    - Fixes: CVE-2021-46790, CVE-2022-30783, CVE-2022-30784, CVE-2022-30785,       CVE-2022-30786, CVE-2022-30787, CVE-2022-30788, CVE-2022-30789       resolves: rhbz#2127240 rhbz#2127248       (also: 2127233 2127234 2127241 2127249 2127255 2127256 2127262 2127263)
    - Fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289,       CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269,       CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE-2021-39254       resolves: rhbz#2004490
    - Fix for CVE-2019-9755       (heap-based buffer overflow leads to local root privilege escalation)       resolves: rhbz#1698503
    - Fix CVE-2024-7383 NBD server improper certificate validation       resolves: RHEL-52728
    - Fix CVE-2022-0485: Fail nbdcopy if NBD read or write fails       resolves: rhbz#2045718
    - Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842).
    - Backport 'tpm2: Check size of buffer before accessing it' (CVE-2023-1017 & CVE-2023-1018)       Resolves: rhbz#2173964       Resolves: rhbz#2173970
    - Fix CVE-2021-3746 libtpms: out-of-bounds access via specially crafted TPM 2 command packets       Resolves: rhbz#1999307
    - Fix CVE-2021-3623: out-of-bounds access when trying to resume the state of the vTPM       Fixes: rhbz#1976816
    - rpc: ensure temporary GSource is removed from client event loop (Daniel P. Berrange) [Orabug: 36821472]     {CVE-2024-4418}
    - Fix CVE-2021-3716 NBD_OPT_STRUCTURED_REPLY injection on STARTTLS       resolves: rhbz#1994915
    - io: fix use after free in websocket handshake code (Daniel P. Berrange) [Orabug: 38687831]     {CVE-2025-11234}
    - hw/usb/hcd-uhci: don't assert for SETUP to non-0 endpoint (Peter Maydell) [Orabug: 37517799]     {CVE-2024-8354}
    - target/i386: Enumerate verw-clear CPUID feature (Boris Ostrovsky) [Orabug: 38118557] {CVE-2024-36350}     {CVE-2024-36357}
    - Add fix for CVE-2022-23645.
      Resolves: rhbz#2056517
    - Update to 0.4.2, to address potential symlink vulnerabilities (CVE-2020-28407).
      Resolves: rhbz#1906043
    - Fix CVE-2022-2211 Denial of Service in --key parameter       resolves: rhbz#2102720

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3165 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    Security Fix(es):

    * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:3077 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    Security Fix(es):

    * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0436-1 advisory.

    - CVE-2025-11234: Fixed use-after-free in websocket handshake code can lead to denial of service     (bsc#1250984).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:1831 advisory.

    * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:1831 advisory.

    * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:1831 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    Security Fix(es):

    * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-1831 advisory.

    - Resolves: RHEL-120118       (CVE-2025-11234 qemu-kvm: VNC WebSocket handshake use-after-free [rhel-10.1.z])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0288-1 advisory.

    Security issues fixed:

    - CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a     malicious       guest user to crash the QEMU process on the host (bsc#1253002).
    - CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client     with network       access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

    Other updates and bugfixes:

    - [openSUSE][RPM] spec: require qemu-hw-display-virtio-gpu-pci for x86 too.
    - [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).
    - [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).
    - block/curl: fix curl internal handles handling (bsc#1252768).
    - [openSUSE][RPM] spec: qemu-vgabios is required on ppc (bsc#1230042).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0039-1 advisory.

    - CVE-2024-6505: qemu-kvm: virtio-net: Fixed queue index       out-of-bounds access in software RSS (bsc#1227397)
    - CVE-2025-12464: net: pad packets to minimum length in       qemu_receive_packet() (bsc#1253002)
    - CVE-2025-11234: qemu-kvm: Fixed use-after-free in websocket       handshake code leading to denial of service (bsc#1250984)

    Other fixes:
    - Fixed *-virtio-gpu-pci dependency on ARM (bsc#1254286)
    - block/curl: Fixed curl internal handles handling (bsc#1252768)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0022-1 advisory.

    Security issues fixed:

    - CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a     malicious       guest user to crash the QEMU process on the host (bsc#1253002).
    - CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client     with network       access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

    Other updates and bugfixes:

    - [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).
    - block/curl: fix curl internal handles handling (bsc#1252768).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:21233-1 advisory.

    Update to version 10.0.7.

    Security issues fixed:

    - CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a     malicious       guest user to crash the QEMU process on the host (bsc#1253002).
    - CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client     with network       access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

    Other updates and bugfixes:

    - Version 10.0.7:
      * kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
      * docs/devel: Update URL for make-pullreq script
      * target/arm: Fix assert on BRA.
      * hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
      * hw/core/machine: Provide a description for aux-ram-share property
      * hw/pci: Make msix_init take a uint32_t for nentries
      * block/io_uring: avoid potentially getting stuck after resubmit at the end of ioq_submit()
      * block-backend: Fix race when resuming queued requests
      * ui/vnc: Fix qemu abort when query vnc info
      * chardev/char-pty: Do not ignore chr_write() failures
      * hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
      * hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
      * hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure
      * migration: Fix transition to COLO state from precopy
      * Full backport list: https://lore.kernel.org/qemu-     devel/1765037524.347582.2700543.nullmailer@tls.msk.ru/

    - Version 10.0.6:
      * linux-user/microblaze: Fix little-endianness binary
      * target/hppa: correct size bit parity for fmpyadd
      * target/i386: user: do not set up a valid LDT on reset
      * async: access bottom half flags with qatomic_read
      * target/i386: fix x86_64 pushw op
      * i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit
      * i386/cpu: Prevent delivering SIPI during SMM in TCG mode
      * i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS
      * target/i386: Fix CR2 handling for non-canonical addresses
      * block/curl.c: Use explicit long constants in curl_easy_setopt calls
      * pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs
      * target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN2 and SEWd
      * target/riscv: Fix ssamoswap error handling
      * Full backport list: https://lore.kernel.org/qemu-devel/1761022287.744330.6357.nullmailer@tls.msk.ru/

    - Version 10.0.5:
      * tests/functional/test_aarch64_sbsaref_freebsd: Fix the URL of the ISO image
      * tests/functional/test_ppc_bamboo: Replace broken link with working assets
      * physmem: Destroy all CPU AddressSpaces on unrealize
      * memory: New AS helper to serialize destroy+free
      * include/system/memory.h: Clarify address_space_destroy() behaviour
      * migration: Fix state transition in postcopy_start() error handling
      * target/riscv: rvv: Modify minimum VLEN according to enabled vector extensions
      * target/riscv: rvv: Replace checking V by checking Zve32x
      * target/riscv: Fix endianness swap on compressed instructions
      * hw/riscv/riscv-iommu: Fixup PDT Nested Walk
      * Full backport list: https://lore.kernel.org/qemu-devel/1759986125.676506.643525.nullmailer@tls.msk.ru/

    - [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).
    - [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:20171-1 advisory.

    Update to version 10.0.7.

    Security issues fixed:

    - CVE-2025-12464: stack-based buffer overflow in the e1000 network device operations can be exploited by a     malicious       guest user to crash the QEMU process on the host (bsc#1253002).
    - CVE-2025-11234: use-after-free in WebSocket handshake operations can be exploited by a malicious client     with network       access to the VNC WebSocket port to cause a denial-of-service (bsc#1250984).

    Other updates and bugfixes:

    - Version 10.0.7:
      * kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl() return value
      * docs/devel: Update URL for make-pullreq script
      * target/arm: Fix assert on BRA.
      * hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to DEVICE_LITTLE_ENDIAN
      * hw/core/machine: Provide a description for aux-ram-share property
      * hw/pci: Make msix_init take a uint32_t for nentries
      * block/io_uring: avoid potentially getting stuck after resubmit at the end of ioq_submit()
      * block-backend: Fix race when resuming queued requests
      * ui/vnc: Fix qemu abort when query vnc info
      * chardev/char-pty: Do not ignore chr_write() failures
      * hw/display/exynos4210_fimd: Account for zero length in fimd_update_memory_section()
      * hw/arm/armv7m: Disable reentrancy guard for v7m_sysreg_ns_ops MRs
      * hw/arm/aspeed: Fix missing SPI IRQ connection causing DMA interrupt failure
      * migration: Fix transition to COLO state from precopy
      * Full backport list: https://lore.kernel.org/qemu-     devel/1765037524.347582.2700543.nullmailer@tls.msk.ru/

    - Version 10.0.6:
      * linux-user/microblaze: Fix little-endianness binary
      * target/hppa: correct size bit parity for fmpyadd
      * target/i386: user: do not set up a valid LDT on reset
      * async: access bottom half flags with qatomic_read
      * target/i386: fix x86_64 pushw op
      * i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit
      * i386/cpu: Prevent delivering SIPI during SMM in TCG mode
      * i386/kvm: Expose ARCH_CAP_FB_CLEAR when invulnerable to MDS
      * target/i386: Fix CR2 handling for non-canonical addresses
      * block/curl.c: Use explicit long constants in curl_easy_setopt calls
      * pcie_sriov: Fix broken MMIO accesses from SR-IOV VFs
      * target/riscv: rvv: Fix vslide1[up|down].vx unexpected result when XLEN2 and SEWd
      * target/riscv: Fix ssamoswap error handling
      * Full backport list: https://lore.kernel.org/qemu-devel/1761022287.744330.6357.nullmailer@tls.msk.ru/

    - Version 10.0.5:
      * tests/functional/test_aarch64_sbsaref_freebsd: Fix the URL of the ISO image
      * tests/functional/test_ppc_bamboo: Replace broken link with working assets
      * physmem: Destroy all CPU AddressSpaces on unrealize
      * memory: New AS helper to serialize destroy+free
      * include/system/memory.h: Clarify address_space_destroy() behaviour
      * migration: Fix state transition in postcopy_start() error handling
      * target/riscv: rvv: Modify minimum VLEN according to enabled vector extensions
      * target/riscv: rvv: Replace checking V by checking Zve32x
      * target/riscv: Fix endianness swap on compressed instructions
      * hw/riscv/riscv-iommu: Fixup PDT Nested Walk
      * Full backport list: https://lore.kernel.org/qemu-devel/1759986125.676506.643525.nullmailer@tls.msk.ru/

    - [openSUSE][RPM]: really fix *-virtio-gpu-pci dependency on ARM (bsc#1254286).
    - [openSUSE][RPM] spec: make glusterfs support conditional (bsc#1254494).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23228 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    Security Fix(es):

    * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3044 advisory.

    A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a     handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-     free in the use of the channel. This can be abused by a malicious client with network access to the VNC     WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client     authentication. (CVE-2025-11234)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a     handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-     free in the use of the channel. This can be abused by a malicious client with network access to the VNC     WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client     authentication. (CVE-2025-11234)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
301155	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : QEMU vulnerabilities (USN-8073-1)	Nessus	Ubuntu Local Security Checks	medium
299967	Oracle Linux 8 : virt:kvm_utils3 (ELSA-2026-50118)	Nessus	Oracle Linux Local Security Checks	medium
299856	RHEL 9 : qemu-kvm (RHSA-2026:3165)	Nessus	Red Hat Local Security Checks	high
299788	RHEL 9 : qemu-kvm (RHSA-2026:3077)	Nessus	Red Hat Local Security Checks	high
298727	SUSE SLES15 Security Update : qemu (SUSE-SU-2026:0436-1)	Nessus	SuSE Local Security Checks	high
298507	AlmaLinux 10 : qemu-kvm (ALSA-2026:1831)	Nessus	Alma Linux Local Security Checks	high
298206	RockyLinux 10 : qemu-kvm (RLSA-2026:1831)	Nessus	Rocky Linux Local Security Checks	high
298157	RHEL 10 : qemu-kvm (RHSA-2026:1831)	Nessus	Red Hat Local Security Checks	high
297860	Oracle Linux 10 : qemu-kvm (ELSA-2026-1831)	Nessus	Oracle Linux Local Security Checks	high
296664	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2026:0288-1)	Nessus	SuSE Local Security Checks	high
281910	SUSE SLES15 Security Update : qemu (SUSE-SU-2026:0039-1)	Nessus	SuSE Local Security Checks	medium
281891	SUSE SLES15 / openSUSE 15 Security Update : qemu (SUSE-SU-2026:0022-1)	Nessus	SuSE Local Security Checks	high
279669	SUSE SLES16 Security Update : qemu (SUSE-SU-2025:21233-1)	Nessus	SuSE Local Security Checks	high
279668	openSUSE 16 Security Update : qemu (openSUSE-SU-2025:20171-1)	Nessus	SuSE Local Security Checks	high
278988	RHEL 9 : qemu-kvm (RHSA-2025:23228)	Nessus	Red Hat Local Security Checks	high
271772	Amazon Linux 2 : qemu, --advisory ALAS2-2025-3044 (ALAS-2025-3044)	Nessus	Amazon Linux Local Security Checks	high
269461	Linux Distros Unpatched Vulnerability : CVE-2025-11234	Nessus	Misc.	high

Detections

Analytics

CVE-2025-11234

high

Tenable Plugins

medium

medium

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

high