Threat database

A use-after-free vulnerability (CVE-2025-11234) exists in the qemu-kvm component's VNC WebSocket handshake in Red Hat Enterprise Linux 9. This vulnerability is rated moderate severity by Red Hat Product Security and is addressed in the Red Hat OpenShift Container Platform 4.12.97 update. The update fixes the issue specifically in qemu-kvm but does not include additional security fixes for OpenShift itself. Users running affected versions of Red Hat Enterprise Linux 9 are advised to apply the update to remediate the vulnerability.

Red Hat released a security update for qemu-kvm in Red Hat Enterprise Linux 9 addressing multiple vulnerabilities including a buffer overflow, a double free, and a denial of service. These issues affect versions prior to 9.5.0 and have been rated with moderate severity. A patch is available and should be applied to mitigate these vulnerabilities.

A denial of service vulnerability (CVE-2024-7409) exists in the QEMU NBD server component used by qemu-kvm, caused by improper synchronization during socket closure. This affects the user-space virtualization component in Red Hat Enterprise Linux 9.4 Extended Update Support and related versions. The issue has been rated as moderate severity by Red Hat. A security update is available to address this vulnerability.