This Red Hat security advisory (RHSA-2024:9136) addresses three vulnerabilities in the qemu-kvm packages used in Red Hat Enterprise Linux 9. CVE-2024-26327 is a buffer overflow caused by improper validation of the NumVFs parameter in SR-IOV functionality. CVE-2024-3446 is a double free vulnerability stemming from a DMA reentrancy issue in the virtio device emulation. CVE-2024-7409 involves a denial of service vulnerability due to improper synchronization in the QEMU NBD server during socket closure. These vulnerabilities could lead to memory corruption or service disruption in virtualized environments. The advisory provides updated qemu-kvm packages to fix these issues and is rated with moderate security impact by Red Hat Product Security.

The vulnerabilities impact the qemu-kvm user-space virtualization component in Red Hat Enterprise Linux 9. The buffer overflow (CVE-2024-26327) and double free (CVE-2024-3446) could potentially lead to memory corruption, which may be exploitable to cause crashes or other unintended behavior. The denial of service vulnerability (CVE-2024-7409) could disrupt virtual machine operations by causing the QEMU NBD server to improperly synchronize during socket closure. No known exploits in the wild have been reported at this time.

Red Hat has released updated qemu-kvm packages for Red Hat Enterprise Linux 9 and its extended update and life cycle support variants that address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2024:9136 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Since this is an official fix, applying the update is the recommended mitigation. No additional vendor-recommended mitigations are indicated.