QEMU fixes QED heap leak to guests (CVE-2026-118594)

QEMU has fixed CVE-2026-118594, a flaw in the QED block driver that could leak host heap memory into a guest.

The bug was in the helper that converts a byte length into a cluster count. It divided by one less than the configured cluster size instead of by the full cluster size, a slip Stefan Hajnoczi traced to a likely copy-paste from nearby mask arithmetic. Wrong cluster counts then opened a path for a guest-visible heap leak.

Exploitation needs a QED image with cluster size at most 32 KB (the format default is 64 KB) and table size 8 or 16 (the default is 4). Images that stick to the usual defaults are not in the vulnerable configuration.

Hajnoczi landed the one-line correction on the QEMU development list. The issue was reported by oxsignal.