How many CVEs have a located fix in debian/qemu?

52 published CVEs have a fix traced to functions in debian/qemu, touching 299 functions across 128 files.

Which function in debian/qemu has been patched by the most CVEs?

sdhci_send_command in hw/sd/sdhci.c has been changed by 3 CVE fixes, from 2020 to 2021.

How large is a typical CVE fix in debian/qemu?

The median fix changes 10 lines. 77% of fixes change 20 lines or fewer, and 50% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

c

rust

#77 of 500 repositories

debian/qemu

Name: debian/qemu: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 10, 2026

52

CVE fixes located

Published CVEs

299

Functions patched

Distinct function sites

128

Files patched

Distinct source files

2013–2026

Years covered

By CVE publication date

Overview

52 published CVEs have a fix traced to functions in debian/qemu, the earliest published in 2013. Those fixes changed 299 distinct functions across 128 files, in 829 patch hunks.

Among the 500 repositories tracked here, debian/qemu ranks #77 by the number of CVEs with a located fix.

Most patched functions

Functions in debian/qemu changed by the most CVE fixes.

Most patched files

Files in debian/qemu changed by the most CVE fixes.

1hw/sd/sdhci.c5 CVEs · 4 functions
2hw/9pfs/9p-local.c3 CVEs · 16 functions
3hw/9pfs/9p.c3 CVEs · 5 functions
4contrib/vhost-user-gpu/virgl.c3 CVEs · 1 functions
5hw/9pfs/9p-xattr.c2 CVEs · 4 functions
6hw/block/fdc.c2 CVEs · 4 functions
7hw/scsi/mptsas.c2 CVEs · 4 functions
8hw/usb/hcd-xhci.c2 CVEs · 4 functions
9hw/scsi/megasas.c2 CVEs · 3 functions
10slirp/tcp_subr.c2 CVEs · 1 functions

Fix size

How much code a CVE fix in debian/qemu changes, with backports counted once.

10

Median lines changed

Added plus removed, per CVE

77%

Fixes of 20 lines or fewer

Share of CVE fixes

50%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in debian/qemu, and the functions each fix changed.

Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access
CVE-2026-6426vmstate_n_elems VMStateFlags size_of_ptr_type
Medium · CVSS 4.4
EPSS 0.4%2026-08-10
CVE-2023-3301
CVE-2023-3301vhost_vdpa_cleanup
Medium · CVSS 5.6
EPSS 0.3%2023-09-13
CVE-2020-14394
CVE-2020-14394xhci_ring_chain_length
Low · CVSS 3.2
EPSS 0.4%2022-08-17
CVE-2021-3582
CVE-2021-3582pvrdma_map_to_pdir
Medium · CVSS 6.5
EPSS 0.4%2022-03-25
CVE-2021-3638
CVE-2021-3638ati_2d_blt
Medium · CVSS 6.5
EPSS 0.4%2022-03-03
CVE-2021-3713
CVE-2021-3713usb_uas_handle_data
High · CVSS 7.4
EPSS 0.6%2021-08-25
CVE-2021-3546
CVE-2021-3546
High · CVSS 8.2
EPSS 0.5%2021-06-02
CVE-2021-3545
CVE-2021-3545
Medium · CVSS 6.5
EPSS 0.4%2021-06-02
CVE-2021-3544
CVE-2021-3544iovec
Medium · CVSS 6.5
EPSS 0.4%2021-06-02
CVE-2021-20196
CVE-2021-20196get_cur_drv blk_create_empty_drive floppy_drive_realize
Medium · CVSS 6.5
EPSS 0.5%2021-05-26
CVE-2021-20221
CVE-2021-20221gic_dist_writel
Medium · CVSS 6.0
EPSS 0.3%2021-05-13
CVE-2021-20181
CVE-2021-20181v9fs_mark_fids_unreclaim
High · CVSS 7.5
EPSS 0.3%2021-05-13

Get an alert for each new debian/qemu CVE, with the patched functions and AI-written analysis.

Monitor qemu CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

py-pdf/pypdf52 CVEs wordpress/wordpress52 CVEs froxlor/froxlor53 CVEs grokability/snipe-it53 CVEs dataease/dataease51 CVEs fusionpbx/fusionpbx51 CVEs patriksimek/vm251 CVEs gogs/gogs54 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in debian/qemu.

How many CVEs have a located fix in debian/qemu?: 52 published CVEs have a fix traced to functions in debian/qemu, touching 299 functions across 128 files.
Which function in debian/qemu has been patched by the most CVEs?: sdhci_send_command in hw/sd/sdhci.c has been changed by 3 CVE fixes, from 2020 to 2021.
How large is a typical CVE fix in debian/qemu?: The median fix changes 10 lines. 77% of fixes change 20 lines or fewer, and 50% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track debian/qemu CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing