ALAS2023-2026-3241

Amazon Linux 2023 Security Advisory: ALAS2023-2026-3241
Advisory Released Date: 2026-10-24
Advisory Updated Date: 2026-10-26

Severity: Important

References: CVE-2026-17588 CVE-2026-18054 CVE-2026-50624 CVE-2026-61402 CVE-2026-61476 CVE-2026-63110 CVE-2026-63320 CVE-2026-63321 CVE-2026-63322 CVE-2026-66899 CVE-2026-66900 CVE-2026-77913 CVE-2026-81627 CVE-2026-84788 CVE-2026-93834
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

hw/usb/hcd-xhci: Set reentrancy guard in timer functions (CVE-2026-17588)

NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1f24066fc88d33455ee54a20f29994d9e69997ba (v11.1.0-rc3)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/5fbd2fe1cc54259d045d00d4966aa2db1ba990d6 (v11.0.4) (CVE-2026-18054)

NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3917
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/0be94d8d9c28e6b7235b34133d057090fe93be6c (v11.1.0-rc2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/88a0e5e45b41d407cf9adf1f2cf6f20f394a578d (v11.0.4) (CVE-2026-50624)

NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/733a98a552e4bd68932de1f58bd6ea39b57b261c (v11.1.0-rc2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/6680c5612401c1eaa49eba134d14d374fefeb9d4 (v11.0.4) (CVE-2026-61402)

NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3875
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f404bf0e6504e0412a00ea64708f17d2a5e3f869 (v11.1.0-rc2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/a4abe1f1fa6f465b64fb400bea14c72bd5e32ac9 (v11.0.4) (CVE-2026-61476)

NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/b9d248dfaca5e31377ea4f7204aae788a050bafd (v11.1.0-rc2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/82520d7759557062a5fae2211e3c79bbd5f01ed3 (v11.0.4) (CVE-2026-63110)

Host-side AddressSanitizer heap-buffer-overflow READ in current QEMU master through the virtio-net-pci receive filtering path on q35. The crash is in receive_filter(). (CVE-2026-63320)

NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/a6e0519ea8ed6fc84fab9bf9ca82c7a55780f880 (v11.1.0-rc2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/52c7bb369b23dfcafb6e6d90665c777797b55e88 (v11.1.0-rc2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f348425fddae38e0c1d6823501890acfb2a3bfb1 (v11.0.4)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/9a06bb17256c0a38f0b53025bf804d2e2035f93f (v11.0.4) (CVE-2026-63321)

NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3607
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/4727cc883b7e81d2c30b9801af54482d65b84292 (v11.1.0-rc2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/95b9a1bf26fef7c44f4925f78ade7fa824ed5e76 (v11.0.4) (CVE-2026-63322)

virtio-balloon: fix free-page BH teardown on unrealize (CVE-2026-66899)

hw/net/virtio-net: strip trailing padding when caching RSC segment (CVE-2026-66900)

hw/display/vga: fix text-mode OOB write after a graphics surface switch (CVE-2026-77913)

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory. (CVE-2026-81627)

io/channel-socket: do not treat a zero length write as an error (CVE-2026-84788)

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user. (CVE-2026-93834)

Affected Packages:

qemu

Issue Correction:
Run dnf update qemu --releasever 2023.12.20261026 or dnf update --advisory ALAS2023-2026-3241 --releasever 2023.12.20261026 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    qemu-system-aarch64-core-debuginfo-11.0.0-4.amzn2023.aarch64
    qemu-user-static-x86-debuginfo-11.0.0-4.amzn2023.aarch64
    qemu-tools-debuginfo-11.0.0-4.amzn2023.aarch64
    qemu-guest-agent-11.0.0-4.amzn2023.aarch64
    qemu-user-binfmt-11.0.0-4.amzn2023.aarch64
    qemu-img-debuginfo-11.0.0-4.amzn2023.aarch64
    qemu-pr-helper-11.0.0-4.amzn2023.aarch64
    qemu-pr-helper-debuginfo-11.0.0-4.amzn2023.aarch64
    qemu-11.0.0-4.amzn2023.aarch64
    qemu-img-11.0.0-4.amzn2023.aarch64
    qemu-kvm-core-11.0.0-4.amzn2023.aarch64
    qemu-user-static-x86-11.0.0-4.amzn2023.aarch64
    qemu-kvm-11.0.0-4.amzn2023.aarch64
    qemu-system-aarch64-core-11.0.0-4.amzn2023.aarch64
    qemu-debuginfo-11.0.0-4.amzn2023.aarch64
    qemu-common-debuginfo-11.0.0-4.amzn2023.aarch64
    qemu-user-debuginfo-11.0.0-4.amzn2023.aarch64
    qemu-user-static-aarch64-debuginfo-11.0.0-4.amzn2023.aarch64
    qemu-debugsource-11.0.0-4.amzn2023.aarch64
    qemu-guest-agent-debuginfo-11.0.0-4.amzn2023.aarch64
    qemu-system-x86-core-debuginfo-11.0.0-4.amzn2023.aarch64
    qemu-user-static-11.0.0-4.amzn2023.aarch64
    qemu-system-aarch64-11.0.0-4.amzn2023.aarch64
    qemu-user-11.0.0-4.amzn2023.aarch64
    qemu-tests-11.0.0-4.amzn2023.aarch64
    qemu-tests-debuginfo-11.0.0-4.amzn2023.aarch64
    qemu-system-x86-11.0.0-4.amzn2023.aarch64
    qemu-tools-11.0.0-4.amzn2023.aarch64
    qemu-common-11.0.0-4.amzn2023.aarch64
    qemu-user-static-aarch64-11.0.0-4.amzn2023.aarch64
    qemu-system-x86-core-11.0.0-4.amzn2023.aarch64

noarch:
    qemu-docs-11.0.0-4.amzn2023.noarch

src:
    qemu-11.0.0-4.amzn2023.src

x86_64:
    qemu-system-aarch64-core-debuginfo-11.0.0-4.amzn2023.x86_64
    qemu-user-static-11.0.0-4.amzn2023.x86_64
    qemu-pr-helper-debuginfo-11.0.0-4.amzn2023.x86_64
    qemu-user-debuginfo-11.0.0-4.amzn2023.x86_64
    qemu-system-aarch64-11.0.0-4.amzn2023.x86_64
    qemu-user-static-x86-debuginfo-11.0.0-4.amzn2023.x86_64
    qemu-img-debuginfo-11.0.0-4.amzn2023.x86_64
    qemu-tests-debuginfo-11.0.0-4.amzn2023.x86_64
    qemu-guest-agent-debuginfo-11.0.0-4.amzn2023.x86_64
    qemu-kvm-11.0.0-4.amzn2023.x86_64
    qemu-user-static-aarch64-11.0.0-4.amzn2023.x86_64
    qemu-user-static-aarch64-debuginfo-11.0.0-4.amzn2023.x86_64
    qemu-debuginfo-11.0.0-4.amzn2023.x86_64
    qemu-kvm-core-11.0.0-4.amzn2023.x86_64
    qemu-system-x86-core-debuginfo-11.0.0-4.amzn2023.x86_64
    qemu-user-static-x86-11.0.0-4.amzn2023.x86_64
    qemu-common-debuginfo-11.0.0-4.amzn2023.x86_64
    qemu-system-x86-11.0.0-4.amzn2023.x86_64
    qemu-11.0.0-4.amzn2023.x86_64
    qemu-guest-agent-11.0.0-4.amzn2023.x86_64
    qemu-user-binfmt-11.0.0-4.amzn2023.x86_64
    qemu-tools-11.0.0-4.amzn2023.x86_64
    qemu-tools-debuginfo-11.0.0-4.amzn2023.x86_64
    qemu-user-11.0.0-4.amzn2023.x86_64
    qemu-pr-helper-11.0.0-4.amzn2023.x86_64
    qemu-img-11.0.0-4.amzn2023.x86_64
    qemu-system-aarch64-core-11.0.0-4.amzn2023.x86_64
    qemu-system-x86-core-11.0.0-4.amzn2023.x86_64
    qemu-common-11.0.0-4.amzn2023.x86_64
    qemu-tests-11.0.0-4.amzn2023.x86_64
    qemu-debugsource-11.0.0-4.amzn2023.x86_64

Additional References

Release Notes: Amazon Linux 2023 Release Notes

Red Hat: CVE-2026-17588, CVE-2026-18054, CVE-2026-50624, CVE-2026-61402, CVE-2026-61476, CVE-2026-63110, CVE-2026-63320, CVE-2026-63321, CVE-2026-63322, CVE-2026-66899, CVE-2026-66900, CVE-2026-77913, CVE-2026-81627, CVE-2026-84788, CVE-2026-93834

Mitre: CVE-2026-17588, CVE-2026-18054, CVE-2026-50624, CVE-2026-61402, CVE-2026-61476, CVE-2026-63110, CVE-2026-63320, CVE-2026-63321, CVE-2026-63322, CVE-2026-66899, CVE-2026-66900, CVE-2026-77913, CVE-2026-81627, CVE-2026-84788, CVE-2026-93834