Debian Linux - qemu - None

Ubuntu Linux - [virtio-scsi request size mismatch]

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50337 advisory.

    - Limit recursion in ri-records (CVE-2021-3622)       resolves: rhbz#1976194
    - Bounds check for block exceeding page length (CVE-2021-3504)       resolves: rhbz#1950501
    - Fixes: CVE-2022-40284
    - Fixes: CVE-2021-46790, CVE-2022-30783, CVE-2022-30784, CVE-2022-30785,       CVE-2022-30786, CVE-2022-30787, CVE-2022-30788, CVE-2022-30789       resolves: rhbz#2127240 rhbz#2127248       (also: 2127233 2127234 2127241 2127249 2127255 2127256 2127262 2127263)
    - Fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289,       CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269,       CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE-2021-39254       resolves: rhbz#2004490
    - Fix for CVE-2019-9755       (heap-based buffer overflow leads to local root privilege escalation)       resolves: rhbz#1698503
    - Fix CVE-2024-7383 NBD server improper certificate validation       resolves: RHEL-52728
    - Fix CVE-2022-0485: Fail nbdcopy if NBD read or write fails       resolves: rhbz#2045718
    - Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842).
    - Fix CVE-2025-49133       Resolves: RHEL-96251
    - Backport 'tpm2: Check size of buffer before accessing it' (CVE-2023-1017 & CVE-2023-1018)       Resolves: rhbz#2173964       Resolves: rhbz#2173970
    - Fix CVE-2021-3746 libtpms: out-of-bounds access via specially crafted TPM 2 command packets       Resolves: rhbz#1999307
    - Fix CVE-2021-3623: out-of-bounds access when trying to resume the state of the vTPM       Fixes: rhbz#1976816
    - Fix CVE-2021-3716 NBD_OPT_STRUCTURED_REPLY injection on STARTTLS       resolves: rhbz#1994915
    - ui: fix validation of VNC extended clipboard data length (Heechan Kang) [Orabug: 39442988]     {CVE-2026-8343}
    - ui/vnc: fix OOB read updating VNC update frequency stats (Daniel P. Berrange) [Orabug: 39447326]     {CVE-2026-48003}
    - ui/vnc: fix OOB write in lossy rect worker code (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002}
    - ui/vnc: fix OOB write in VNC stats array (Daniel P. Berrange) [Orabug: 39447332] {CVE-2026-48002}
    - lsi53c895a: keep a reference to the device while SCRIPTS execute (Paolo Bonzini) [Orabug: 37517793]     {CVE-2024-6519}
    - hw/scsi/lsi53c895a: fix memory leak in lsi_scsi_realize() (Zheng Huang) [Orabug: 37517793]     {CVE-2024-6519}
    - hw/scsi/lsi53c895a: bump instruction limit in scripts processing to fix regression (Fiona Ebner)     [Orabug: 37517793] {CVE-2024-6519}
    - hw/scsi/lsi53c895a: add timer to scripts processing (Sven Schnelle) [Orabug: 37517793] {CVE-2024-6519}
    - virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare (Paolo     Bonzini) [Orabug: 39414097] {CVE-2026-5763}
    - softmmu: Support concurrent bounce buffers (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
    - system/physmem: Per-AddressSpace bounce buffering (Mattias Nissler) [Orabug: 37509310] {CVE-2024-8612}
    - system/physmem: Propagate AddressSpace to MapClient helpers (Mattias Nissler) [Orabug: 37509310]     {CVE-2024-8612}
    - Document CVEs (Mark Kanda) {CVE-2025-54566} {CVE-2025-54567} {CVE-2025-8860} {CVE-2026-0665}     {CVE-2026-3886}
    - hw/usb/hcd-ohci: check for MPS=0 to avoid infinite loop (Jenny Guanni Qu) [Orabug: 39160764]     {CVE-2026-3890}
    - hyperv/syndbg: check length returned by cpu_physical_memory_map() (Paolo Bonzini) [Orabug: 39160749]     {CVE-2026-3842}
    - block/vmdk: fix OOB read in vmdk_read_extent() (Halil Oktay) [Orabug: 39160776] {CVE-2026-2243}
    - cryptodev-builtin: Limit the maximum size (zhenwei pi) [Orabug: 39173335] {CVE-2025-14876}
    - hw/virtio/virtio-crypto: verify asym request size (zhenwei pi) [Orabug: 39173335] {CVE-2025-14876}
    - io: fix use after free in websocket handshake code (Daniel P. Berrange) [Orabug: 38687831]     {CVE-2025-11234}

    seabios
    - Add fix for CVE-2022-23645.
      Resolves: rhbz#2056517
    - Update to 0.4.2, to address potential symlink vulnerabilities (CVE-2020-28407).
      Resolves: rhbz#1906043
    - Fix CVE-2022-2211 Denial of Service in --key parameter       resolves: rhbz#2102720

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3293 advisory.

    hcd-ohci: infinite loop

    NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/129922c2bc398b656a9180150e667f98fdf0d402     (v11.0.0-rc1) (CVE-2026-3890)

    virtio-scsi request size mismatch

    NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/79971302935472232a68073faddb085177e3ca54     (v11.0.0-rc3) (CVE-2026-5763)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - qemu - None  Ubuntu Linux - [virtio-scsi request size mismatch] (CVE-2026-5763)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
322307	Oracle Linux 8 : virt:kvm_utils3 (ELSA-2026-50337)	Nessus	Oracle Linux Local Security Checks	high
314591	Amazon Linux 2 : qemu, --advisory ALAS2-2026-3293 (ALAS-2026-3293)	Nessus	Amazon Linux Local Security Checks	medium
309865	Linux Distros Unpatched Vulnerability : CVE-2026-5763	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-5763

high

Tenable Plugins

high

medium

medium