QEMU lands virtio security fixes for OOB reads and writes
Three patches from Michael S. Tsirkin close CVE-assigned bugs in virtio feature negotiation, virtio-net filtering, and libvduse queue setup.
QEMU picked up a cluster of virtio-related security fixes that close three CVEs covering out-of-bounds reads in networking paths and an out-of-bounds write in libvduse. The changes, sent by Michael S. Tsirkin, harden feature negotiation, short-frame handling, and virtqueue size checks so malicious or buggy guests and peers cannot trip host memory errors.
The most severe item is in libvduse. Queue enable accepted a virtqueue size from VDUSE_VQ_GET_INFO without checking it against the maximum. A value above that limit overran the inflight log and produced out-of-bounds writes when the queue tracked inflight descriptors. The virtio spec only allows the size to shrink from the configured maximum, but the kernel VDUSE side does not enforce that for userspace, so the library now rejects oversized values. That issue is tracked as CVE-2026-61402.
Two fixes target virtio-net exposure to short or hostile input. Feature negotiation through set_features_ex was handing the device the raw guest feature bits instead of the host-masked set used elsewhere. A malicious or buggy driver could therefore turn on bits the host never offered. In virtio-net that path could enable receive-side coalescing without the needed vnet header support and lead to out-of-bounds reads on short packets. The call now passes the masked features, consistent with the ordinary set_features path (CVE-2026-63321).
Separately, receive_filter read Ethernet and VLAN header fields without length checks. Because virtio-net asks backends not to pad, socket and similar backends can deliver frames shorter than the Ethernet minimum. Those truncated frames caused out-of-bounds reads in the filter. The code now drops frames that are too short for a basic header or a VLAN tag before touching those fields (CVE-2026-63320).
Taken together, the batch tightens assumptions virtio code made about peer honesty and minimum frame size, which matters for any host that exposes virtio-net or VDUSE to untrusted guests or backends.