CVE-2016-2858: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.10 only; version 16.04 only
• Debian Debian Linux: version 8.0 only
• Qemu Qemu: up to and including 2.5.1.1

Published 2016-04-07. Last modified 2026-06-17.